vibecheck-ai 1.2.1 → 1.2.2

package/dist/index.js

@@ -1689,9 +1689,264 @@ function createDriftEvent(type, severity, file2, operation, description, context
     context
   };
 }
-var FEATURE_KEYS, FEATURE_METADATA, PLAN_DEFINITIONS, TIER_ORDER, UPGRADE_URLS, VERDICT_THRESHOLDS, SEVERITY_PENALTIES, PERMISSIONS;
+var ENTITLEMENTS, FREE_ENTITLEMENTS, PRO_ENTITLEMENTS, FEATURE_KEYS, FEATURE_METADATA, PLAN_DEFINITIONS, TIER_ORDER, UPGRADE_URLS, VERDICT_THRESHOLDS, SEVERITY_PENALTIES, PERMISSIONS;
 var init_dist = __esm({
   "../../packages/shared-types/dist/index.js"() {
+    ENTITLEMENTS = {
+      // === FREE Tier Entitlements ===
+      SCAN_UNLIMITED: "scan_unlimited",
+      SHIP_GATE: "ship_gate",
+      DOCTOR: "doctor",
+      REPORTS_HTML: "reports_html",
+      CHECKPOINT: "checkpoint",
+      MISSIONS_VIEW: "missions_view",
+      TEMPLATES_BROWSE: "templates_browse",
+      TEMPLATES_INSTALL: "templates_install",
+      TRUTHPACK_GENERATE: "truthpack_generate",
+      TRUTHPACK_VALIDATE: "truthpack_validate",
+      FORGE_BASIC: "forge_basic",
+      PROMPT_TEMPLATES_BASIC: "prompt_templates_basic",
+      WATCH_MODE: "watch_mode",
+      TRACE_ANALYSIS: "trace_analysis",
+      GITHUB_ACTION_WARN: "github_action_warn",
+      FIREWALL_OBSERVE: "firewall_observe",
+      FILE_LOCKING: "file_locking",
+      // === PRO Tier Entitlements ===
+      REALITY_MODE: "reality_mode",
+      CONTEXT_ENGINE: "context_engine",
+      ISL_STUDIO: "isl_studio",
+      FIREWALL_AGENT: "firewall_agent",
+      FIREWALL_ENFORCE: "firewall_enforce",
+      FIREWALL_LOCKDOWN: "firewall_lockdown",
+      AUTOFIX: "autofix",
+      AUTOFIX_APPLY: "autofix_apply",
+      CERTIFY: "certify",
+      BADGE_VERIFIED: "badge_verified",
+      CHAOS_AGENT: "chaos_agent",
+      REPORTS_PDF: "reports_pdf",
+      REPORTS_EXECUTIVE: "reports_executive",
+      FORGE_EXTENDED: "forge_extended",
+      REPLAY_VIEWER_FULL: "replay_viewer_full",
+      PROOF_HISTORY: "proof_history",
+      CLOUD_SYNC: "cloud_sync",
+      TEAM_COLLABORATION: "team_collaboration",
+      API_ACCESS: "api_access",
+      WEBHOOKS: "webhooks",
+      CI_GATE_BLOCK: "ci_gate_block",
+      AI_GENERATION: "ai_generation",
+      POLICIES: "policies",
+      WORKFLOWS: "workflows",
+      PRIORITY_SUPPORT: "priority_support",
+      PROMPT_TEMPLATES_PRO: "prompt_templates_pro",
+      // === Enterprise Tier Entitlements ===
+      SSO: "sso",
+      AUDIT_LOGS: "audit_logs",
+      CUSTOM_POLICIES: "custom_policies",
+      ON_PREM: "on_prem",
+      SLA: "sla",
+      DEDICATED_SUPPORT: "dedicated_support",
+      FORGE_COMPREHENSIVE: "forge_comprehensive",
+      PROMPT_TEMPLATES_CUSTOM: "prompt_templates_custom",
+      COMPLIANCE_REPORTS: "compliance_reports"
+    };
+    FREE_ENTITLEMENTS = /* @__PURE__ */ new Set([
+      ENTITLEMENTS.SCAN_UNLIMITED,
+      ENTITLEMENTS.SHIP_GATE,
+      ENTITLEMENTS.DOCTOR,
+      ENTITLEMENTS.REPORTS_HTML,
+      ENTITLEMENTS.CHECKPOINT,
+      ENTITLEMENTS.MISSIONS_VIEW,
+      ENTITLEMENTS.TEMPLATES_BROWSE,
+      ENTITLEMENTS.TEMPLATES_INSTALL,
+      ENTITLEMENTS.TRUTHPACK_GENERATE,
+      ENTITLEMENTS.TRUTHPACK_VALIDATE,
+      ENTITLEMENTS.FORGE_BASIC,
+      ENTITLEMENTS.PROMPT_TEMPLATES_BASIC,
+      ENTITLEMENTS.WATCH_MODE,
+      ENTITLEMENTS.TRACE_ANALYSIS,
+      ENTITLEMENTS.GITHUB_ACTION_WARN,
+      ENTITLEMENTS.FIREWALL_OBSERVE,
+      ENTITLEMENTS.FILE_LOCKING
+    ]);
+    PRO_ENTITLEMENTS = /* @__PURE__ */ new Set([
+      // Includes all FREE entitlements
+      ...FREE_ENTITLEMENTS,
+      // Plus PRO-only entitlements
+      ENTITLEMENTS.REALITY_MODE,
+      ENTITLEMENTS.CONTEXT_ENGINE,
+      ENTITLEMENTS.ISL_STUDIO,
+      ENTITLEMENTS.FIREWALL_AGENT,
+      ENTITLEMENTS.FIREWALL_ENFORCE,
+      ENTITLEMENTS.FIREWALL_LOCKDOWN,
+      ENTITLEMENTS.AUTOFIX,
+      ENTITLEMENTS.AUTOFIX_APPLY,
+      ENTITLEMENTS.CERTIFY,
+      ENTITLEMENTS.BADGE_VERIFIED,
+      ENTITLEMENTS.CHAOS_AGENT,
+      ENTITLEMENTS.REPORTS_PDF,
+      ENTITLEMENTS.REPORTS_EXECUTIVE,
+      ENTITLEMENTS.FORGE_EXTENDED,
+      ENTITLEMENTS.REPLAY_VIEWER_FULL,
+      ENTITLEMENTS.PROOF_HISTORY,
+      ENTITLEMENTS.CLOUD_SYNC,
+      ENTITLEMENTS.TEAM_COLLABORATION,
+      ENTITLEMENTS.API_ACCESS,
+      ENTITLEMENTS.WEBHOOKS,
+      ENTITLEMENTS.CI_GATE_BLOCK,
+      ENTITLEMENTS.AI_GENERATION,
+      ENTITLEMENTS.POLICIES,
+      ENTITLEMENTS.WORKFLOWS,
+      ENTITLEMENTS.PRIORITY_SUPPORT,
+      ENTITLEMENTS.PROMPT_TEMPLATES_PRO
+    ]);
+    /* @__PURE__ */ new Set([
+      // Includes all PRO entitlements
+      ...PRO_ENTITLEMENTS,
+      // Plus Enterprise-only entitlements
+      ENTITLEMENTS.SSO,
+      ENTITLEMENTS.AUDIT_LOGS,
+      ENTITLEMENTS.CUSTOM_POLICIES,
+      ENTITLEMENTS.ON_PREM,
+      ENTITLEMENTS.SLA,
+      ENTITLEMENTS.DEDICATED_SUPPORT,
+      ENTITLEMENTS.FORGE_COMPREHENSIVE,
+      ENTITLEMENTS.PROMPT_TEMPLATES_CUSTOM,
+      ENTITLEMENTS.COMPLIANCE_REPORTS
+    ]);
+    ({
+      [ENTITLEMENTS.REALITY_MODE]: {
+        entitlement: ENTITLEMENTS.REALITY_MODE,
+        title: "Reality Mode",
+        description: "Browser-based runtime verification catches issues static analysis misses.",
+        benefits: [
+          "Browser-based route testing",
+          "Screenshot evidence",
+          "Runtime error detection",
+          "Network request validation"
+        ],
+        docsUrl: "/docs/reality-mode"
+      },
+      [ENTITLEMENTS.CONTEXT_ENGINE]: {
+        entitlement: ENTITLEMENTS.CONTEXT_ENGINE,
+        title: "Context Engine",
+        description: "Full AI context generation for rules, agents, skills, and hooks.",
+        benefits: [
+          "Auto-generated AI rules",
+          "Agent configuration",
+          "Skill definitions",
+          "Pre-commit hooks"
+        ],
+        docsUrl: "/docs/context-engine"
+      },
+      [ENTITLEMENTS.ISL_STUDIO]: {
+        entitlement: ENTITLEMENTS.ISL_STUDIO,
+        title: "ISL Studio",
+        description: "Intent Specification Language builder for spec-first development.",
+        benefits: [
+          "Visual ISL editor",
+          "Contract generation",
+          "Verification integration",
+          "Export to code"
+        ],
+        docsUrl: "/docs/isl-studio"
+      },
+      [ENTITLEMENTS.FIREWALL_ENFORCE]: {
+        entitlement: ENTITLEMENTS.FIREWALL_ENFORCE,
+        title: "Firewall Enforce Mode",
+        description: "Block AI changes before they happen, not after.",
+        benefits: [
+          "Pre-save blocking",
+          "Real-time validation",
+          "Hallucination prevention",
+          "Audit logging"
+        ],
+        docsUrl: "/docs/firewall"
+      },
+      [ENTITLEMENTS.AUTOFIX_APPLY]: {
+        entitlement: ENTITLEMENTS.AUTOFIX_APPLY,
+        title: "Auto-Fix Apply",
+        description: "AI-powered code repair with rollback support.",
+        benefits: [
+          "One-click fixes",
+          "Rollback support",
+          "Fix verification",
+          "Batch application"
+        ],
+        docsUrl: "/docs/autofix"
+      },
+      [ENTITLEMENTS.CERTIFY]: {
+        entitlement: ENTITLEMENTS.CERTIFY,
+        title: "Certify",
+        description: "Generate proof bundles and certification for your code.",
+        benefits: [
+          "Signed proof bundles",
+          "Verification endpoint",
+          "Compliance documentation",
+          "Badge generation"
+        ],
+        docsUrl: "/docs/certify"
+      },
+      [ENTITLEMENTS.BADGE_VERIFIED]: {
+        entitlement: ENTITLEMENTS.BADGE_VERIFIED,
+        title: "Verified Ship Badge",
+        description: "Show your code quality commitment with a verified badge.",
+        benefits: [
+          "Dynamic SVG badge",
+          "Real-time Ship Score",
+          "Verified checkmark",
+          "README embed code"
+        ],
+        docsUrl: "/docs/badges"
+      },
+      [ENTITLEMENTS.CHAOS_AGENT]: {
+        entitlement: ENTITLEMENTS.CHAOS_AGENT,
+        title: "Chaos Agent",
+        description: "AI-powered bug hunting finds issues you would miss.",
+        benefits: [
+          "AI-powered exploration",
+          "Edge case discovery",
+          "Security testing",
+          "Reproducible tests"
+        ],
+        docsUrl: "/docs/chaos-agent"
+      },
+      [ENTITLEMENTS.CLOUD_SYNC]: {
+        entitlement: ENTITLEMENTS.CLOUD_SYNC,
+        title: "Cloud Sync",
+        description: "Sync truthpacks and scan history across devices and team.",
+        benefits: [
+          "Cross-device access",
+          "Team sharing",
+          "Automatic backup",
+          "90-day retention"
+        ],
+        docsUrl: "/docs/cloud-sync"
+      },
+      [ENTITLEMENTS.TEAM_COLLABORATION]: {
+        entitlement: ENTITLEMENTS.TEAM_COLLABORATION,
+        title: "Team Collaboration",
+        description: "Work together on code quality with your team.",
+        benefits: [
+          "Unlimited team members",
+          "Role-based access",
+          "Shared projects",
+          "Team analytics"
+        ],
+        docsUrl: "/docs/teams"
+      },
+      [ENTITLEMENTS.API_ACCESS]: {
+        entitlement: ENTITLEMENTS.API_ACCESS,
+        title: "API Access",
+        description: "Integrate VibeCheck into your existing tools and workflows.",
+        benefits: [
+          "RESTful API",
+          "Webhook support",
+          "CI/CD integration",
+          "Custom automation"
+        ],
+        docsUrl: "/docs/api"
+      }
+    });
     FEATURE_KEYS = {
       // Dashboard features
       CLOUD_SYNC: "cloud_sync",
@@ -2334,45 +2589,53 @@ var init_dist = __esm({
       free: {
         id: "free",
         name: "Free",
-        tagline: "Perfect for individual developers",
+        tagline: "Everything you need to find issues",
         price: 0,
         priceLabel: "$0",
         interval: "month",
         features: [
-          "Full CLI access (all commands)",
-          "5 scans per month",
-          "Basic SARIF output",
-          "3 local projects",
-          "7-day scan history",
-          "Community support"
+          "Unlimited scans",
+          "Unlimited ship decisions",
+          "Doctor (health checks)",
+          "HTML reports",
+          "Checkpoint create/restore",
+          "Mission packs (view)",
+          "Template gallery + install",
+          "Forge basic (5 rules)",
+          "Watch mode",
+          "7-day history"
         ],
         limits: {
           projects: 3,
-          scansPerMonth: 5,
-          // 5 per month for free tier
+          scansPerMonth: -1,
+          // Unlimited
           seats: 1,
           retentionDays: 7
         },
-        bestFor: "Solo developers and small side projects",
+        bestFor: "Finding issues in your codebase",
         cta: "Current Plan",
         ctaVariant: "secondary"
       },
       pro: {
         id: "pro",
         name: "Pro",
-        tagline: "For teams shipping production code",
-        price: 29,
-        priceLabel: "$29",
+        tagline: "Prevent issues and prove it",
+        price: 19,
+        priceLabel: "$19",
         interval: "month",
         features: [
           "Everything in Free",
-          "Cloud sync & dashboard",
-          "Unlimited projects",
-          "Team collaboration",
+          "Reality Mode (runtime verification)",
+          "Context Engine (full AI context)",
+          "ISL Studio (spec-first workflow)",
+          "Firewall Agent (enforce + lockdown)",
+          "Auto-Fix (apply fixes)",
+          "Certify + Verified Badge",
+          "Chaos Agent (AI bug hunting)",
+          "PDF & executive reports",
+          "Cloud sync & teams",
           "API access & webhooks",
-          "Policy engine",
-          "90-day scan history",
-          "Priority support"
+          "90-day history"
         ],
         limits: {
           projects: -1,
@@ -2381,7 +2644,7 @@ var init_dist = __esm({
           seats: -1,
           retentionDays: 90
         },
-        bestFor: "Growing teams and production applications",
+        bestFor: "Teams shipping production code with confidence",
         popular: true,
         cta: "Upgrade to Pro",
         ctaVariant: "default"
@@ -2389,19 +2652,19 @@ var init_dist = __esm({
       enterprise: {
         id: "enterprise",
         name: "Enterprise",
-        tagline: "For organizations with advanced needs",
+        tagline: "For organizations with compliance needs",
         price: null,
         priceLabel: "Custom",
         interval: null,
         features: [
           "Everything in Pro",
-          "SSO/SAML authentication",
+          "SSO/SAML (Okta, Azure AD)",
           "Audit logs (365-day retention)",
           "Custom policies",
           "On-premises deployment",
-          "Dedicated support team",
-          "SLA guarantee",
-          "Custom training"
+          "Compliance reports",
+          "Dedicated support",
+          "SLA guarantee"
         ],
         limits: {
           projects: -1,
@@ -2409,7 +2672,7 @@ var init_dist = __esm({
           seats: -1,
           retentionDays: 365
         },
-        bestFor: "Large organizations with compliance requirements",
+        bestFor: "Organizations with security & compliance requirements",
         cta: "Contact Sales",
         ctaVariant: "outline"
       }
@@ -16238,8 +16501,6 @@ var init_chunk_KVOEVY4C = __esm({
     };
   }
 });
-
-// ../../packages/core/dist/chunk-VCXA3YAU.js
 function calculateHealthScore(counts) {
   const penalty = counts.critical * SEVERITY_PENALTIES.critical + counts.high * SEVERITY_PENALTIES.high + counts.medium * SEVERITY_PENALTIES.medium + counts.low * SEVERITY_PENALTIES.low;
   const score = Math.max(0, 100 - Math.min(100, penalty));
@@ -16518,6 +16779,173 @@ function formatShipScore(score) {
   };
   return `Ship Score: ${score.total}/100 ${verdictEmoji[score.verdict]} ${score.verdict}`;
 }
+function generateProofBundle(score, input, options) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const evidence = [];
+  const routes = input.truthpack?.routes || [];
+  for (const route of routes.slice(0, 10)) {
+    evidence.push({
+      type: "route_verified",
+      subject: `${route.method || "GET"} ${route.path}`,
+      result: "pass",
+      confidence: 0.9,
+      timestamp
+    });
+  }
+  const envVars = input.truthpack?.env || [];
+  for (const env2 of envVars.slice(0, 10)) {
+    evidence.push({
+      type: "env_verified",
+      subject: env2.name,
+      result: env2.present ? "pass" : "fail",
+      confidence: env2.present ? 0.95 : 0.8,
+      timestamp
+    });
+  }
+  if (input.truthpack?.auth) {
+    evidence.push({
+      type: "auth_verified",
+      subject: "Auth Configuration",
+      result: score.metrics.authConfigured ? "pass" : "fail",
+      confidence: 0.85,
+      details: `${score.metrics.protectedRoutes} protected routes`,
+      timestamp
+    });
+  }
+  if (input.realityResults?.ran) {
+    evidence.push({
+      type: "reality_test",
+      subject: "Reality Mode Verification",
+      result: input.realityResults.routesFailed === 0 ? "pass" : "fail",
+      confidence: 0.95,
+      details: `${input.realityResults.routesPassed}/${input.realityResults.routesTested} passed`,
+      timestamp
+    });
+  }
+  if (input.mockDetectionResults) {
+    evidence.push({
+      type: "mock_scan",
+      subject: "Mock Data Scan",
+      result: input.mockDetectionResults.summary.total === 0 ? "pass" : "fail",
+      confidence: 0.9,
+      details: `${input.mockDetectionResults.summary.total} findings`,
+      timestamp
+    });
+  }
+  const verificationChain = [
+    {
+      step: 1,
+      action: "Ghost Risk Analysis",
+      result: `${score.metrics.verifiedRoutes}/${score.metrics.totalRoutes} routes verified`,
+      scoreContribution: score.dimensions.ghostRisk
+    },
+    {
+      step: 2,
+      action: "Auth Coverage Analysis",
+      result: `${score.metrics.protectedRoutes} routes protected`,
+      scoreContribution: score.dimensions.authCoverage
+    },
+    {
+      step: 3,
+      action: "Env Integrity Check",
+      result: `${score.metrics.presentEnvVars}/${score.metrics.requiredEnvVars} required vars present`,
+      scoreContribution: score.dimensions.envIntegrity
+    },
+    {
+      step: 4,
+      action: "Runtime Proof Collection",
+      result: score.metrics.realityModeRan ? `${score.metrics.routesTestedInReality} routes tested, ${Math.round(score.metrics.realityPassRate * 100)}% pass rate` : "Reality mode not executed",
+      scoreContribution: score.dimensions.runtimeProof
+    },
+    {
+      step: 5,
+      action: "Contract Alignment Check",
+      result: `${score.metrics.alignedContracts}/${score.metrics.totalContracts} contracts aligned`,
+      scoreContribution: score.dimensions.contractsAlignment
+    },
+    {
+      step: 6,
+      action: "Mock Data Cleanliness",
+      result: score.metrics.mockDataFindings === 0 ? "No mock data found" : `${score.metrics.mockDataFindings} mock data findings`,
+      scoreContribution: score.dimensions.mockDataCleanliness
+    }
+  ];
+  let verdict;
+  if (score.verdict === "SHIP" && score.total >= 80) {
+    verdict = "PROVEN";
+  } else if (score.verdict === "BLOCK") {
+    verdict = "FAILED";
+  } else {
+    verdict = "INCOMPLETE_PROOF";
+  }
+  const bundleContent = {
+    version: "1.0.0",
+    timestamp,
+    projectId: options?.projectId,
+    commitHash: options?.commitHash,
+    score,
+    evidence,
+    verificationChain,
+    verdict
+  };
+  const contentString = JSON.stringify(bundleContent);
+  const bundleId = crypto52.createHash("sha256").update(contentString).digest("hex").slice(0, 16);
+  const bundle = {
+    bundleId,
+    ...bundleContent
+  };
+  if (options?.signingKey) {
+    const signatureValue = crypto52.createHmac("sha256", options.signingKey).update(JSON.stringify(bundle)).digest("base64");
+    bundle.signature = {
+      algorithm: "HMAC-SHA256",
+      value: signatureValue,
+      keyId: crypto52.createHash("sha256").update(options.signingKey).digest("hex").slice(0, 8),
+      signedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  return bundle;
+}
+function verifyProofBundle(bundle, signingKey) {
+  const { bundleId, signature, ...content } = bundle;
+  const contentString = JSON.stringify(content);
+  const expectedId = crypto52.createHash("sha256").update(contentString).digest("hex").slice(0, 16);
+  if (bundleId !== expectedId) {
+    return { valid: false, reason: "Bundle ID does not match content hash" };
+  }
+  if (bundle.signature && signingKey) {
+    const expectedSignature = crypto52.createHmac("sha256", signingKey).update(JSON.stringify({ bundleId, ...content })).digest("base64");
+    if (bundle.signature.value !== expectedSignature) {
+      return { valid: false, reason: "Signature verification failed" };
+    }
+  }
+  return { valid: true };
+}
+function formatProofBundle(bundle) {
+  const lines = [];
+  lines.push("");
+  lines.push("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557");
+  lines.push("\u2551                    VIBECHECK PROOF BUNDLE                          \u2551");
+  lines.push("\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563");
+  lines.push(`\u2551  Bundle ID:  ${bundle.bundleId.padEnd(50)}  \u2551`);
+  lines.push(`\u2551  Timestamp:  ${bundle.timestamp.slice(0, 19).padEnd(50)}  \u2551`);
+  lines.push(`\u2551  Verdict:    ${bundle.verdict.padEnd(50)}  \u2551`);
+  lines.push("\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563");
+  lines.push(`\u2551  Ship Score: ${bundle.score.total}/100`.padEnd(67) + "  \u2551");
+  lines.push("\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563");
+  lines.push("\u2551  Verification Chain:                                               \u2551");
+  for (const step of bundle.verificationChain) {
+    const line = `    ${step.step}. ${step.action}: ${step.result}`.slice(0, 64);
+    lines.push(`\u2551  ${line.padEnd(64)}  \u2551`);
+  }
+  lines.push("\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563");
+  lines.push(`\u2551  Evidence Items: ${bundle.evidence.length}`.padEnd(67) + "  \u2551");
+  if (bundle.signature) {
+    lines.push("\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563");
+    lines.push(`\u2551  Signed: ${bundle.signature.algorithm} (key: ${bundle.signature.keyId})`.padEnd(67) + "  \u2551");
+  }
+  lines.push("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D");
+  return lines.join("\n");
+}
 function calculateHybridScore(input) {
   const { islResult, traditionalScore, mode } = input;
   if (mode === "isl" && islResult) {
@@ -16578,8 +17006,8 @@ function createISLScorer() {
   return new ISLScorer();
 }
 var CATEGORY_SCORE_CONFIG, MAX_DIMENSION_SCORE, VERDICT_THRESHOLDS2, GHOST_WEIGHTS, SENSITIVE_ROUTE_PATTERNS, ShipScoreCalculator, shipScoreCalculator, ISL_WEIGHTS, ISL_VERDICT_THRESHOLDS, ISLScorer, islScorer;
-var init_chunk_VCXA3YAU = __esm({
-  "../../packages/core/dist/chunk-VCXA3YAU.js"() {
+var init_chunk_GXXYXSWF = __esm({
+  "../../packages/core/dist/chunk-GXXYXSWF.js"() {
     init_dist();
     init_dist();
     CATEGORY_SCORE_CONFIG = {
@@ -25720,7 +26148,7 @@ var init_chunk_C5JUH5R4 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-QJNHJVEI.js
+// ../../packages/core/dist/chunk-GZFCACMG.js
 function getLogger2() {
   if (!loggerInstance) {
     loggerInstance = {
@@ -26298,8 +26726,8 @@ function gateFeature(userTier, feature, context) {
   }
 }
 var CATEGORY_INFO, TIER_INFO, loggerInstance, registry, TIER_LEVELS, TierAccessError, devMode, UPGRADE_TRIGGERS, FeatureGatedError;
-var init_chunk_QJNHJVEI = __esm({
-  "../../packages/core/dist/chunk-QJNHJVEI.js"() {
+var init_chunk_GZFCACMG = __esm({
+  "../../packages/core/dist/chunk-GZFCACMG.js"() {
     init_chunk_C5JUH5R4();
     init_dist();
     CATEGORY_INFO = {
@@ -26355,7 +26783,7 @@ var init_chunk_QJNHJVEI = __esm({
         name: "PRO",
         description: "Cloud features, team collaboration, API access",
         color: "blue",
-        price: "$29/dev/mo"
+        price: "$19/dev/mo"
       },
       enterprise: {
         name: "ENTERPRISE",
@@ -26577,7 +27005,7 @@ function createConcurrencyLimiter(config = {}) {
 async function runWithConcurrency(items, operation, maxConcurrent) {
   const semaphore = new Semaphore(maxConcurrent);
   const results = [];
-  const promises2 = items.map(async (item, index) => {
+  const promises3 = items.map(async (item, index) => {
     await semaphore.acquire();
     try {
       const result = await operation(item, index);
@@ -26586,7 +27014,7 @@ async function runWithConcurrency(items, operation, maxConcurrent) {
       semaphore.release();
     }
   });
-  await Promise.all(promises2);
+  await Promise.all(promises3);
   return results;
 }
 function createSafetyGuard(config = {}) {
@@ -40726,8 +41154,8 @@ function extractCallsFromSource(source, filePath, options = {}) {
       // ========================================
       // Import Declarations
       // ========================================
-      ImportDeclaration(path310) {
-        const node = path310.node;
+      ImportDeclaration(path62) {
+        const node = path62.node;
         const importInfo = extractImportInfo(node);
         if (!opts.includeTypeImports && importInfo.isTypeOnly) {
           return;
@@ -40747,8 +41175,8 @@ function extractCallsFromSource(source, filePath, options = {}) {
       // ========================================
       // Dynamic Imports
       // ========================================
-      "CallExpression|OptionalCallExpression"(path310) {
-        const node = path310.node;
+      "CallExpression|OptionalCallExpression"(path62) {
+        const node = path62.node;
         if (node.callee.type === "Import") {
           const arg = node.arguments[0];
           let modulePath = "<dynamic>";
@@ -40784,8 +41212,8 @@ function extractCallsFromSource(source, filePath, options = {}) {
       // ========================================
       // Track Defined Symbols
       // ========================================
-      VariableDeclarator(path310) {
-        const id = path310.node.id;
+      VariableDeclarator(path62) {
+        const id = path62.node.id;
         if (id.type === "Identifier") {
           definedSymbols.add(id.name);
         } else if (id.type === "ObjectPattern") {
@@ -40804,38 +41232,38 @@ function extractCallsFromSource(source, filePath, options = {}) {
           }
         }
       },
-      FunctionDeclaration(path310) {
-        if (path310.node.id) {
-          definedSymbols.add(path310.node.id.name);
+      FunctionDeclaration(path62) {
+        if (path62.node.id) {
+          definedSymbols.add(path62.node.id.name);
         }
-        for (const param of path310.node.params) {
+        for (const param of path62.node.params) {
           if (param.type === "Identifier") {
             definedSymbols.add(param.name);
           }
         }
       },
-      ClassDeclaration(path310) {
-        if (path310.node.id) {
-          definedSymbols.add(path310.node.id.name);
+      ClassDeclaration(path62) {
+        if (path62.node.id) {
+          definedSymbols.add(path62.node.id.name);
         }
       },
       // Arrow functions assigned to const
-      ArrowFunctionExpression(path310) {
-        for (const param of path310.node.params) {
+      ArrowFunctionExpression(path62) {
+        for (const param of path62.node.params) {
           if (param.type === "Identifier") {
             definedSymbols.add(param.name);
           }
         }
       },
       // Type declarations (TypeScript)
-      TSTypeAliasDeclaration(path310) {
-        definedSymbols.add(path310.node.id.name);
+      TSTypeAliasDeclaration(path62) {
+        definedSymbols.add(path62.node.id.name);
       },
-      TSInterfaceDeclaration(path310) {
-        definedSymbols.add(path310.node.id.name);
+      TSInterfaceDeclaration(path62) {
+        definedSymbols.add(path62.node.id.name);
       },
-      TSEnumDeclaration(path310) {
-        definedSymbols.add(path310.node.id.name);
+      TSEnumDeclaration(path62) {
+        definedSymbols.add(path62.node.id.name);
       }
     });
   } catch (error) {
@@ -41268,6 +41696,22 @@ function shouldBlock(violation, context) {
       return false;
   }
 }
+function formatViolationMessage(violation) {
+  const icon = violation.tier === "hard_block" ? "\u{1F6D1}" : violation.tier === "soft_block" ? "\u26A0\uFE0F" : "\u2139\uFE0F";
+  const lines = [
+    `${icon} Blocked: ${violation.category}`,
+    `Evidence: ${violation.evidence}`
+  ];
+  if (violation.quickFixes.length > 0) {
+    lines.push("Fix:");
+    violation.quickFixes.slice(0, 3).forEach((fix) => {
+      lines.push(`  \u2705 ${fix.label}`);
+    });
+  } else if (violation.suggestion) {
+    lines.push(`Fix: ${violation.suggestion}`);
+  }
+  return lines.join("\n");
+}
 function createTieredViolation(rule, category, evidence, options = {}) {
   return {
     tier: options.tierOverride ?? getTierForRule(rule),
@@ -41327,9 +41771,35 @@ function getDefaultRules() {
     new UnsafeSideEffectRule().toPolicy()
   ];
 }
-var DEFAULT_CONFIG10, DRIFT_WEIGHTS, ScopeCreepDetector, IntentValidator, DEFAULT_OPTIONS6, PARSER_OPTIONS, ClaimExtractor, DEFAULT_CONFIG25, BUILTIN_MODULES, EvidenceResolver, POLICY_LIMITS, VALID_SEVERITIES, PolicyEngine, UnblockPlanner, DEFAULT_CONFIG34, modeValidator, actionValidator, AgentFirewall, BEHAVIOR_TEMPLATES, ENTITY_TEMPLATES, ISLGenerator, globalGenerator, IntentStore, globalIntentStore, MissionService, globalMissionService, TIER_A_RULES, TIER_B_RULES, BaseRule, DEFAULT_CONFIG44, GhostRouteRule, DEFAULT_CONFIG54, GhostEnvRule, DEFAULT_CONFIG63, AuthDriftRule, DEFAULT_CONFIG72, ContractDriftRule, DEFAULT_CONFIG82, ScopeExplosionRule, DEFAULT_CONFIG92, UnsafeSideEffectRule;
-var init_chunk_YK33YEF4 = __esm({
-  "../../packages/core/dist/chunk-YK33YEF4.js"() {
+function createObserveModeManager(onComplete) {
+  return new ObserveModeManager({
+    observeDuration: 120,
+    // 2 minutes
+    observeSaveCount: 20,
+    // or 20 saves
+    onComplete
+  });
+}
+function createAllowlistManager(projectRoot) {
+  return new AllowlistManager(projectRoot);
+}
+async function isAllowed(projectRoot, type, value) {
+  const manager = new AllowlistManager(projectRoot);
+  await manager.load();
+  switch (type) {
+    case "route":
+      return manager.isRouteAllowed(value);
+    case "env":
+      return manager.isEnvVarAllowed(value);
+    case "path":
+      return manager.isPathIgnored(value);
+    default:
+      return false;
+  }
+}
+var DEFAULT_CONFIG10, DRIFT_WEIGHTS, ScopeCreepDetector, IntentValidator, DEFAULT_OPTIONS6, PARSER_OPTIONS, ClaimExtractor, DEFAULT_CONFIG25, BUILTIN_MODULES, EvidenceResolver, POLICY_LIMITS, VALID_SEVERITIES, PolicyEngine, UnblockPlanner, DEFAULT_CONFIG34, modeValidator, actionValidator, AgentFirewall, ContractGenerator, ContractVerifier, DEFAULT_WEIGHTS, TrustScorer, BEHAVIOR_TEMPLATES, ENTITY_TEMPLATES, ISLGenerator, globalGenerator, IntentStore, globalIntentStore, MissionService, globalMissionService, TIER_A_RULES, TIER_B_RULES, TIER_C_RULES, BaseRule, DEFAULT_CONFIG44, GhostRouteRule, DEFAULT_CONFIG54, GhostEnvRule, DEFAULT_CONFIG63, AuthDriftRule, DEFAULT_CONFIG72, ContractDriftRule, DEFAULT_CONFIG82, ScopeExplosionRule, DEFAULT_CONFIG92, UnsafeSideEffectRule, ObserveModeManager, DEFAULT_ALLOWLIST, ALLOWLIST_FILENAME, AllowlistManager;
+var init_chunk_4MEEGNJS = __esm({
+  "../../packages/core/dist/chunk-4MEEGNJS.js"() {
     init_chunk_DFJL4MLU();
     init_chunk_SKXQ6JUA();
     init_chunk_4EQXFW4J();
@@ -41589,23 +42059,23 @@ var init_chunk_YK33YEF4 = __esm({
       /**
        * Categorize a drift event
        */
-      categorizeDrift(path310, operation) {
-        if (this.matchesSensitivePattern(path310)) {
+      categorizeDrift(path62, operation) {
+        if (this.matchesSensitivePattern(path62)) {
           return {
             category: "sensitive_area",
-            reason: `Path "${path310}" touches sensitive area (auth/billing/security)`
+            reason: `Path "${path62}" touches sensitive area (auth/billing/security)`
           };
         }
-        if (this.isDependencyFile(path310) && operation !== "read") {
+        if (this.isDependencyFile(path62) && operation !== "read") {
           return {
             category: "dependency_drift",
-            reason: `Modifying dependency file "${path310}" without declaration`
+            reason: `Modifying dependency file "${path62}" without declaration`
           };
         }
-        if (this.isInDifferentPackage(path310)) {
+        if (this.isInDifferentPackage(path62)) {
           return {
             category: "package_drift",
-            reason: `Path "${path310}" is in a different package than declared scope`
+            reason: `Path "${path62}" is in a different package than declared scope`
           };
         }
         if (!this.isAllowedOperation(operation)) {
@@ -41614,8 +42084,8 @@ var init_chunk_YK33YEF4 = __esm({
             reason: `Operation "${operation}" not allowed in current plan`
           };
         }
-        if (!this.isPathAllowed(path310)) {
-          const dir = this.getDirectory(path310);
+        if (!this.isPathAllowed(path62)) {
+          const dir = this.getDirectory(path62);
           if (dir && !this.existingDirectories.has(dir)) {
             return {
               category: "directory_outside_scope",
@@ -41624,12 +42094,12 @@ var init_chunk_YK33YEF4 = __esm({
           }
           return {
             category: "unpredicted_file",
-            reason: `File "${path310}" not in predicted files or allowed patterns`
+            reason: `File "${path62}" not in predicted files or allowed patterns`
           };
         }
         return {
           category: "unpredicted_file",
-          reason: `File "${path310}" was not predicted by the change plan`
+          reason: `File "${path62}" was not predicted by the change plan`
         };
       }
       // ============================================================================
@@ -41729,15 +42199,15 @@ var init_chunk_YK33YEF4 = __esm({
         }
         return patterns;
       }
-      isPredictedFile(path310) {
+      isPredictedFile(path62) {
         if (!this.activePlan) return false;
         return this.activePlan.predictedFiles.some(
-          (predicted) => this.matchPath(path310, predicted)
+          (predicted) => this.matchPath(path62, predicted)
         );
       }
-      isInScope(path310, operation) {
+      isInScope(path62, operation) {
         if (!this.activePlan) return true;
-        if (this.activePlan.blockedPatterns.some((pattern) => this.matchGlob(path310, pattern))) {
+        if (this.activePlan.blockedPatterns.some((pattern) => this.matchGlob(path62, pattern))) {
           return false;
         }
         if (!this.activePlan.expectedOperations.includes(operation)) {
@@ -41745,33 +42215,33 @@ var init_chunk_YK33YEF4 = __esm({
             return false;
           }
         }
-        if (this.isPredictedFile(path310)) {
+        if (this.isPredictedFile(path62)) {
           return true;
         }
-        return this.isPathAllowed(path310);
+        return this.isPathAllowed(path62);
       }
-      isPathAllowed(path310) {
+      isPathAllowed(path62) {
         if (!this.activePlan) return true;
         return this.activePlan.allowedPatterns.some(
-          (pattern) => this.matchGlob(path310, pattern)
+          (pattern) => this.matchGlob(path62, pattern)
         );
       }
       isAllowedOperation(operation) {
         if (!this.activePlan) return true;
         return this.activePlan.expectedOperations.includes(operation) || operation === "read";
       }
-      matchesSensitivePattern(path310) {
+      matchesSensitivePattern(path62) {
         return this.config.sensitivePatterns.some(
-          (pattern) => this.matchGlob(path310, pattern)
+          (pattern) => this.matchGlob(path62, pattern)
         );
       }
-      isDependencyFile(path310) {
-        const filename = path310.split("/").pop() ?? path310;
+      isDependencyFile(path62) {
+        const filename = path62.split("/").pop() ?? path62;
         return this.config.dependencyFiles.some(
-          (dep) => filename === dep || path310.endsWith(dep)
+          (dep) => filename === dep || path62.endsWith(dep)
         );
       }
-      isInDifferentPackage(path310) {
+      isInDifferentPackage(path62) {
         if (!this.activePlan) return false;
         const getPackage = (p7) => {
           for (const pkgDir of this.config.packageDirectories) {
@@ -41789,28 +42259,28 @@ var init_chunk_YK33YEF4 = __esm({
           if (pkg2) allowedPackages.add(pkg2);
         }
         if (allowedPackages.size === 0) return false;
-        const pathPackage = getPackage(path310);
+        const pathPackage = getPackage(path62);
         if (!pathPackage) return false;
         return !allowedPackages.has(pathPackage);
       }
-      matchPath(path310, pattern) {
-        const normalizedPath = this.normalizePath(path310);
+      matchPath(path62, pattern) {
+        const normalizedPath = this.normalizePath(path62);
         const normalizedPattern = this.normalizePath(pattern);
         return normalizedPath === normalizedPattern || normalizedPath.endsWith(`/${normalizedPattern}`);
       }
-      matchGlob(path310, pattern) {
-        const normalizedPath = this.normalizePath(path310);
+      matchGlob(path62, pattern) {
+        const normalizedPath = this.normalizePath(path62);
         const normalizedPattern = this.normalizePath(pattern);
         if (normalizedPath === normalizedPattern) return true;
         const regexPattern = normalizedPattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "<<<GLOBSTAR>>>").replace(/\*/g, "[^/]*").replace(/<<<GLOBSTAR>>>/g, ".*").replace(/\?/g, ".");
         const regex = new RegExp(`^${regexPattern}$`);
         return regex.test(normalizedPath);
       }
-      normalizePath(path310) {
-        return path310.replace(/\\/g, "/").replace(/^\.\//, "");
+      normalizePath(path62) {
+        return path62.replace(/\\/g, "/").replace(/^\.\//, "");
       }
-      getDirectory(path310) {
-        const parts = path310.split("/");
+      getDirectory(path62) {
+        const parts = path62.split("/");
         if (parts.length <= 1) return null;
         return parts.slice(0, -1).join("/");
       }
@@ -44150,6 +44620,693 @@ var init_chunk_YK33YEF4 = __esm({
         this.logger.info("Agent firewall disposed");
       }
     };
+    ContractGenerator = class {
+      projectRoot;
+      outputDir;
+      contracts = /* @__PURE__ */ new Map();
+      constructor(options) {
+        this.projectRoot = options.projectRoot;
+        this.outputDir = options.outputDir ?? path18.join(options.projectRoot, ".vibecheck", "contracts");
+      }
+      /**
+       * Generate contracts from all detected sources
+       */
+      async generateAll() {
+        const contracts = [];
+        const zodContracts = await this.generateFromZod();
+        contracts.push(...zodContracts);
+        const tsContracts = await this.generateFromTypeScript();
+        contracts.push(...tsContracts);
+        const openApiContracts = await this.generateFromOpenAPI();
+        contracts.push(...openApiContracts);
+        const inferredContracts = await this.inferFromRoutes();
+        contracts.push(...inferredContracts);
+        await this.saveContracts(contracts);
+        return contracts;
+      }
+      /**
+       * Generate contracts from Zod schemas
+       */
+      async generateFromZod() {
+        const contracts = [];
+        const zodFiles = await this.findFiles(["**/*.ts", "**/*.tsx"], /z\.object|z\.string|z\.number/);
+        for (const file2 of zodFiles) {
+          try {
+            const content = await fs15.promises.readFile(file2, "utf-8");
+            const schemas = this.extractZodSchemas(content, file2);
+            for (const schema of schemas) {
+              const spec = this.zodSchemaToISL(schema);
+              contracts.push({
+                spec,
+                metadata: {
+                  generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                  source: {
+                    type: "zod",
+                    file: path18.relative(this.projectRoot, file2),
+                    confidence: 0.9
+                  },
+                  version: "1.0.0"
+                },
+                filePath: path18.join(this.outputDir, `${schema.name}.isl.json`)
+              });
+            }
+          } catch {
+          }
+        }
+        return contracts;
+      }
+      /**
+       * Generate contracts from TypeScript interfaces
+       */
+      async generateFromTypeScript() {
+        const contracts = [];
+        const tsFiles = await this.findFiles(["**/*.ts", "**/*.d.ts"], /interface\s+\w+|type\s+\w+\s*=/);
+        for (const file2 of tsFiles) {
+          try {
+            const content = await fs15.promises.readFile(file2, "utf-8");
+            const interfaces = this.extractTypeScriptInterfaces(content, file2);
+            for (const iface of interfaces) {
+              const spec = this.interfaceToISL(iface);
+              contracts.push({
+                spec,
+                metadata: {
+                  generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                  source: {
+                    type: "typescript",
+                    file: path18.relative(this.projectRoot, file2),
+                    line: iface.line,
+                    confidence: 0.85
+                  },
+                  version: "1.0.0"
+                },
+                filePath: path18.join(this.outputDir, `${iface.name}.isl.json`)
+              });
+            }
+          } catch {
+          }
+        }
+        return contracts;
+      }
+      /**
+       * Generate contracts from OpenAPI specs
+       */
+      async generateFromOpenAPI() {
+        const contracts = [];
+        const specFiles = await this.findFiles(
+          ["**/openapi.yaml", "**/openapi.json", "**/swagger.yaml", "**/swagger.json"],
+          null
+        );
+        for (const file2 of specFiles) {
+          try {
+            const content = await fs15.promises.readFile(file2, "utf-8");
+            const spec = file2.endsWith(".json") ? JSON.parse(content) : this.parseYaml(content);
+            const operations = this.extractOpenAPIOperations(spec);
+            for (const op of operations) {
+              const islSpec = this.operationToISL(op);
+              contracts.push({
+                spec: islSpec,
+                metadata: {
+                  generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                  source: {
+                    type: "openapi",
+                    file: path18.relative(this.projectRoot, file2),
+                    confidence: 0.95
+                  },
+                  version: "1.0.0"
+                },
+                filePath: path18.join(this.outputDir, `${op.operationId || op.path.replace(/\//g, "-")}.isl.json`)
+              });
+            }
+          } catch {
+          }
+        }
+        return contracts;
+      }
+      /**
+       * Infer contracts from route handlers
+       */
+      async inferFromRoutes() {
+        const contracts = [];
+        const routeFiles = await this.findFiles(
+          ["**/routes/**/*.ts", "**/api/**/*.ts", "**/pages/api/**/*.ts"],
+          /app\.(get|post|put|delete|patch)|router\.(get|post|put|delete|patch)|export\s+(async\s+)?function\s+(GET|POST|PUT|DELETE|PATCH)/i
+        );
+        for (const file2 of routeFiles) {
+          try {
+            const content = await fs15.promises.readFile(file2, "utf-8");
+            const handlers = this.extractRouteHandlers(content, file2);
+            for (const handler of handlers) {
+              const spec = this.handlerToISL(handler);
+              contracts.push({
+                spec,
+                metadata: {
+                  generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                  source: {
+                    type: "inferred",
+                    file: path18.relative(this.projectRoot, file2),
+                    line: handler.line,
+                    confidence: 0.7
+                  },
+                  version: "1.0.0"
+                },
+                filePath: path18.join(this.outputDir, `${handler.name}.isl.json`)
+              });
+            }
+          } catch {
+          }
+        }
+        return contracts;
+      }
+      /**
+       * Save contracts to disk
+       */
+      async saveContracts(contracts) {
+        await fs15.promises.mkdir(this.outputDir, { recursive: true });
+        for (const contract of contracts) {
+          await fs15.promises.writeFile(
+            contract.filePath,
+            JSON.stringify({ spec: contract.spec, metadata: contract.metadata }, null, 2)
+          );
+          this.contracts.set(contract.spec.domain, contract);
+        }
+      }
+      /**
+       * Get all loaded contracts
+       */
+      getContracts() {
+        return Array.from(this.contracts.values());
+      }
+      // Helper methods
+      async findFiles(patterns, contentFilter) {
+        const files = [];
+        const walk = async (dir) => {
+          try {
+            const entries = await fs15.promises.readdir(dir, { withFileTypes: true });
+            for (const entry of entries) {
+              const fullPath = path18.join(dir, entry.name);
+              if (entry.isDirectory()) {
+                if (!entry.name.startsWith(".") && entry.name !== "node_modules") {
+                  await walk(fullPath);
+                }
+              } else if (entry.isFile()) {
+                const matches = patterns.some((p7) => {
+                  const ext = path18.extname(entry.name);
+                  return p7.includes(ext) || p7.includes("*");
+                });
+                if (matches) {
+                  if (contentFilter) {
+                    try {
+                      const content = await fs15.promises.readFile(fullPath, "utf-8");
+                      if (contentFilter.test(content)) {
+                        files.push(fullPath);
+                      }
+                    } catch {
+                    }
+                  } else {
+                    files.push(fullPath);
+                  }
+                }
+              }
+            }
+          } catch {
+          }
+        };
+        await walk(this.projectRoot);
+        return files;
+      }
+      extractZodSchemas(content, _file) {
+        const schemas = [];
+        const regex = /(?:export\s+)?(?:const|let)\s+(\w+)\s*=\s*z\.object\s*\(\s*\{([^}]+)\}/g;
+        let match;
+        while ((match = regex.exec(content)) !== null) {
+          schemas.push({ name: match[1], schema: match[2] });
+        }
+        return schemas;
+      }
+      extractTypeScriptInterfaces(_content, _file) {
+        return [];
+      }
+      extractOpenAPIOperations(_spec) {
+        return [];
+      }
+      extractRouteHandlers(_content, _file) {
+        return [];
+      }
+      zodSchemaToISL(schema) {
+        return {
+          version: "1.0",
+          domain: schema.name,
+          behaviors: [{
+            name: `validate${schema.name}`,
+            input: { fields: [] },
+            output: { success: { type: schema.name } }
+          }]
+        };
+      }
+      interfaceToISL(iface) {
+        return {
+          version: "1.0",
+          domain: iface.name,
+          behaviors: []
+        };
+      }
+      operationToISL(op) {
+        return {
+          version: "1.0",
+          domain: op.operationId ?? op.path,
+          behaviors: [{
+            name: `${op.method}${op.path.replace(/\//g, "_")}`,
+            input: { fields: [] },
+            output: {}
+          }]
+        };
+      }
+      handlerToISL(handler) {
+        return {
+          version: "1.0",
+          domain: handler.name,
+          behaviors: [{
+            name: handler.name,
+            description: `${handler.method} ${handler.path}`,
+            input: { fields: [] },
+            output: {}
+          }]
+        };
+      }
+      parseYaml(_content) {
+        return {};
+      }
+    };
+    ContractVerifier = class {
+      projectRoot;
+      contractsDir;
+      contracts = /* @__PURE__ */ new Map();
+      strict;
+      constructor(options) {
+        this.projectRoot = options.projectRoot;
+        this.contractsDir = options.contractsDir ?? path18.join(options.projectRoot, ".vibecheck", "contracts");
+        this.strict = options.strict ?? false;
+      }
+      /**
+       * Load contracts from disk
+       */
+      async loadContracts() {
+        try {
+          const files = await fs15.promises.readdir(this.contractsDir);
+          for (const file2 of files) {
+            if (file2.endsWith(".isl.json")) {
+              try {
+                const content = await fs15.promises.readFile(
+                  path18.join(this.contractsDir, file2),
+                  "utf-8"
+                );
+                const data = JSON.parse(content);
+                this.contracts.set(data.spec.domain, {
+                  spec: data.spec,
+                  metadata: data.metadata,
+                  filePath: path18.join(this.contractsDir, file2)
+                });
+              } catch {
+              }
+            }
+          }
+        } catch {
+        }
+      }
+      /**
+       * Verify a file against its contracts
+       */
+      async verifyFile(filePath) {
+        const violations = [];
+        let verifiedBehaviors = 0;
+        let totalBehaviors = 0;
+        try {
+          const content = await fs15.promises.readFile(filePath, "utf-8");
+          const relativePath = path18.relative(this.projectRoot, filePath);
+          for (const [domain, contract] of this.contracts) {
+            if (this.isApplicable(relativePath, contract)) {
+              for (const behavior of contract.spec.behaviors) {
+                totalBehaviors++;
+                const behaviorViolations = await this.verifyBehavior(
+                  content,
+                  behavior,
+                  domain,
+                  relativePath
+                );
+                if (behaviorViolations.length === 0) {
+                  verifiedBehaviors++;
+                } else {
+                  violations.push(...behaviorViolations);
+                }
+              }
+            }
+          }
+        } catch {
+          violations.push({
+            type: "contract_drift",
+            severity: "error",
+            message: `Could not read file: ${filePath}`,
+            file: filePath,
+            contractName: "unknown",
+            autoFixable: false
+          });
+        }
+        const coverage = totalBehaviors > 0 ? verifiedBehaviors / totalBehaviors * 100 : 100;
+        return {
+          passed: violations.filter((v) => v.severity === "error").length === 0,
+          violations,
+          verifiedBehaviors,
+          totalBehaviors,
+          coverage,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        };
+      }
+      /**
+       * Verify all files in the project
+       */
+      async verifyAll() {
+        const allViolations = [];
+        let totalVerified = 0;
+        let totalBehaviors = 0;
+        const files = await this.findSourceFiles();
+        for (const file2 of files) {
+          const result = await this.verifyFile(file2);
+          allViolations.push(...result.violations);
+          totalVerified += result.verifiedBehaviors;
+          totalBehaviors += result.totalBehaviors;
+        }
+        const coverage = totalBehaviors > 0 ? totalVerified / totalBehaviors * 100 : 100;
+        return {
+          passed: allViolations.filter((v) => v.severity === "error").length === 0,
+          violations: allViolations,
+          verifiedBehaviors: totalVerified,
+          totalBehaviors,
+          coverage,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        };
+      }
+      /**
+       * Verify a single code change against contracts (for firewall integration)
+       */
+      async verifyChange(filePath, oldContent, newContent) {
+        const violations = [];
+        const relativePath = path18.relative(this.projectRoot, filePath);
+        for (const [domain, contract] of this.contracts) {
+          if (this.isApplicable(relativePath, contract)) {
+            const driftViolations = this.detectDrift(
+              oldContent,
+              newContent,
+              contract.spec,
+              relativePath
+            );
+            violations.push(...driftViolations);
+            for (const behavior of contract.spec.behaviors) {
+              const behaviorViolations = await this.verifyBehavior(
+                newContent,
+                behavior,
+                domain,
+                relativePath
+              );
+              violations.push(...behaviorViolations);
+            }
+          }
+        }
+        return violations;
+      }
+      /**
+       * Get all loaded contracts
+       */
+      getContracts() {
+        return Array.from(this.contracts.values());
+      }
+      // Private helpers
+      isApplicable(_filePath, _contract) {
+        return true;
+      }
+      async verifyBehavior(content, behavior, contractName, filePath) {
+        const violations = [];
+        if (behavior.input.fields.length > 0) {
+          const inputViolations = this.checkInputValidation(
+            content,
+            behavior,
+            contractName,
+            filePath
+          );
+          violations.push(...inputViolations);
+        }
+        if (behavior.preconditions) {
+          for (const pre of behavior.preconditions) {
+            if (!this.checkConstraint(content, pre)) {
+              violations.push({
+                type: "constraint_violation",
+                severity: this.strict ? "error" : "warning",
+                message: `Precondition not enforced: ${pre.message ?? pre.expression}`,
+                file: filePath,
+                contractName,
+                behaviorName: behavior.name,
+                suggestion: `Add validation: ${pre.expression}`,
+                autoFixable: true
+              });
+            }
+          }
+        }
+        if (behavior.postconditions) {
+          for (const post of behavior.postconditions) {
+            if (!this.checkConstraint(content, post)) {
+              violations.push({
+                type: "constraint_violation",
+                severity: this.strict ? "error" : "warning",
+                message: `Postcondition not guaranteed: ${post.message ?? post.expression}`,
+                file: filePath,
+                contractName,
+                behaviorName: behavior.name,
+                suggestion: `Ensure: ${post.expression}`,
+                autoFixable: false
+              });
+            }
+          }
+        }
+        if (behavior.errors && behavior.errors.length > 0) {
+          const errorViolations = this.checkErrorHandling(
+            content,
+            behavior,
+            contractName,
+            filePath
+          );
+          violations.push(...errorViolations);
+        }
+        return violations;
+      }
+      checkInputValidation(content, behavior, contractName, filePath) {
+        const violations = [];
+        for (const field of behavior.input.fields) {
+          const hasValidation = content.includes(`${field.name}`) && (content.includes("validate") || content.includes("z.") || content.includes("if ("));
+          if (field.required && !hasValidation) {
+            violations.push({
+              type: "missing_field",
+              severity: this.strict ? "error" : "warning",
+              message: `Required field "${field.name}" lacks validation`,
+              file: filePath,
+              contractName,
+              behaviorName: behavior.name,
+              suggestion: `Add validation for "${field.name}"`,
+              autoFixable: true
+            });
+          }
+        }
+        return violations;
+      }
+      checkConstraint(_content, _constraint) {
+        return true;
+      }
+      checkErrorHandling(content, behavior, contractName, filePath) {
+        const violations = [];
+        for (const error of behavior.errors ?? []) {
+          const hasErrorHandling = content.includes("catch") || content.includes("throw") || content.includes(error);
+          if (!hasErrorHandling) {
+            violations.push({
+              type: "unverified_behavior",
+              severity: "warning",
+              message: `Error "${error}" not explicitly handled`,
+              file: filePath,
+              contractName,
+              behaviorName: behavior.name,
+              suggestion: `Add error handling for ${error}`,
+              autoFixable: false
+            });
+          }
+        }
+        return violations;
+      }
+      detectDrift(oldContent, newContent, spec, filePath) {
+        const violations = [];
+        for (const behavior of spec.behaviors) {
+          if (this.signatureChanged(oldContent, newContent, behavior.name)) {
+            violations.push({
+              type: "contract_drift",
+              severity: "warning",
+              message: `Behavior "${behavior.name}" signature may have changed`,
+              file: filePath,
+              contractName: spec.domain,
+              behaviorName: behavior.name,
+              suggestion: "Review contract compatibility",
+              autoFixable: false
+            });
+          }
+        }
+        return violations;
+      }
+      signatureChanged(oldContent, newContent, behaviorName) {
+        const oldMatch = oldContent.match(new RegExp(`function\\s+${behaviorName}\\s*\\([^)]*\\)`));
+        const newMatch = newContent.match(new RegExp(`function\\s+${behaviorName}\\s*\\([^)]*\\)`));
+        if (!oldMatch || !newMatch) return false;
+        return oldMatch[0] !== newMatch[0];
+      }
+      async findSourceFiles() {
+        const files = [];
+        const walk = async (dir) => {
+          try {
+            const entries = await fs15.promises.readdir(dir, { withFileTypes: true });
+            for (const entry of entries) {
+              const fullPath = path18.join(dir, entry.name);
+              if (entry.isDirectory()) {
+                if (!entry.name.startsWith(".") && entry.name !== "node_modules") {
+                  await walk(fullPath);
+                }
+              } else if (entry.isFile()) {
+                if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) {
+                  files.push(fullPath);
+                }
+              }
+            }
+          } catch {
+          }
+        };
+        await walk(this.projectRoot);
+        return files;
+      }
+    };
+    DEFAULT_WEIGHTS = {
+      coverageWeight: 0.2,
+      verificationWeight: 0.25,
+      stabilityWeight: 0.15,
+      qualityWeight: 0.15,
+      errorHandlingWeight: 0.15,
+      inputValidationWeight: 0.1,
+      trustThreshold: 85,
+      reviewThreshold: 60
+    };
+    TrustScorer = class {
+      options;
+      constructor(options = {}) {
+        this.options = { ...DEFAULT_WEIGHTS, ...options };
+      }
+      /**
+       * Calculate trust score from verification results and contracts
+       */
+      calculate(verificationResult, contracts) {
+        const dimensions = this.calculateDimensions(verificationResult, contracts);
+        const overall = this.calculateOverall(dimensions);
+        const breakdown = this.createBreakdown(verificationResult, contracts);
+        return {
+          overall,
+          dimensions,
+          grade: this.getGrade(overall),
+          verdict: this.getVerdict(overall),
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          breakdown
+        };
+      }
+      /**
+       * Calculate individual dimension scores
+       */
+      calculateDimensions(result, contracts) {
+        const contractCoverage = result.coverage;
+        const verificationRate = result.totalBehaviors > 0 ? result.verifiedBehaviors / result.totalBehaviors * 100 : 100;
+        const driftViolations = result.violations.filter((v) => v.type === "contract_drift");
+        const stability = Math.max(0, 100 - driftViolations.length * 10);
+        const contractQuality = contracts.length > 0 ? contracts.reduce((sum, c) => sum + c.metadata.source.confidence, 0) / contracts.length * 100 : 50;
+        const errorViolations = result.violations.filter((v) => v.type === "unverified_behavior");
+        const errorHandling = Math.max(0, 100 - errorViolations.length * 15);
+        const inputViolations = result.violations.filter((v) => v.type === "missing_field");
+        const inputValidation = Math.max(0, 100 - inputViolations.length * 20);
+        return {
+          contractCoverage,
+          verificationRate,
+          stability,
+          contractQuality,
+          errorHandling,
+          inputValidation
+        };
+      }
+      /**
+       * Calculate overall score from dimensions
+       */
+      calculateOverall(dimensions) {
+        const weighted = dimensions.contractCoverage * this.options.coverageWeight + dimensions.verificationRate * this.options.verificationWeight + dimensions.stability * this.options.stabilityWeight + dimensions.contractQuality * this.options.qualityWeight + dimensions.errorHandling * this.options.errorHandlingWeight + dimensions.inputValidation * this.options.inputValidationWeight;
+        return Math.round(Math.min(100, Math.max(0, weighted)));
+      }
+      /**
+       * Create breakdown of factors
+       */
+      createBreakdown(result, contracts) {
+        const errorViolations = result.violations.filter((v) => v.severity === "error");
+        const warningViolations = result.violations.filter((v) => v.severity === "warning");
+        const highConfidence = contracts.filter((c) => c.metadata.source.confidence >= 0.9);
+        const mediumConfidence = contracts.filter(
+          (c) => c.metadata.source.confidence >= 0.7 && c.metadata.source.confidence < 0.9
+        );
+        const lowConfidence = contracts.filter((c) => c.metadata.source.confidence < 0.7);
+        return {
+          totalBehaviors: result.totalBehaviors,
+          verifiedBehaviors: result.verifiedBehaviors,
+          violations: {
+            errors: errorViolations.length,
+            warnings: warningViolations.length,
+            total: result.violations.length
+          },
+          contracts: {
+            total: contracts.length,
+            highConfidence: highConfidence.length,
+            mediumConfidence: mediumConfidence.length,
+            lowConfidence: lowConfidence.length
+          }
+        };
+      }
+      /**
+       * Get letter grade from score
+       */
+      getGrade(score) {
+        if (score >= 90) return "A";
+        if (score >= 80) return "B";
+        if (score >= 70) return "C";
+        if (score >= 60) return "D";
+        return "F";
+      }
+      /**
+       * Get verdict from score
+       */
+      getVerdict(score) {
+        if (score >= this.options.trustThreshold) return "TRUSTED";
+        if (score >= this.options.reviewThreshold) return "NEEDS_REVIEW";
+        return "UNTRUSTED";
+      }
+      /**
+       * Calculate a quick score from violations only (for firewall use)
+       */
+      calculateFromViolations(violations) {
+        if (violations.length === 0) return 100;
+        const errorPenalty = violations.filter((v) => v.severity === "error").length * 15;
+        const warningPenalty = violations.filter((v) => v.severity === "warning").length * 5;
+        return Math.max(0, 100 - errorPenalty - warningPenalty);
+      }
+      /**
+       * Update options
+       */
+      setOptions(options) {
+        this.options = { ...this.options, ...options };
+      }
+    };
     BEHAVIOR_TEMPLATES = {
       // Authentication patterns
       login: {
@@ -44802,20 +45959,20 @@ domain ${params.domainName} version "${params.version}"
         }
         return this.currentIntent;
       }
-      isPathAllowed(path310, intent) {
-        return intent.allowedPaths.some((pattern) => this.matchPath(path310, pattern));
+      isPathAllowed(path62, intent) {
+        return intent.allowedPaths.some((pattern) => this.matchPath(path62, pattern));
       }
-      isPathExcluded(path310, intent) {
+      isPathExcluded(path62, intent) {
         if (!intent.excludedPaths) return false;
-        return intent.excludedPaths.some((pattern) => this.matchPath(path310, pattern));
+        return intent.excludedPaths.some((pattern) => this.matchPath(path62, pattern));
       }
-      isInTargetFiles(path310, targetFiles) {
+      isInTargetFiles(path62, targetFiles) {
         return targetFiles.some(
-          (target) => path310 === target || path310.endsWith(target) || this.matchPath(path310, target)
+          (target) => path62 === target || path62.endsWith(target) || this.matchPath(path62, target)
         );
       }
-      matchPath(path310, pattern) {
-        const normalizedPath = path310.replace(/\\/g, "/");
+      matchPath(path62, pattern) {
+        const normalizedPath = path62.replace(/\\/g, "/");
         const normalizedPattern = pattern.replace(/\\/g, "/");
         if (normalizedPath === normalizedPattern) return true;
         if (normalizedPattern.includes("*")) {
@@ -45242,22 +46399,22 @@ domain ${params.domainName} version "${params.version}"
       // ============================================================================
       // Path Matching Utilities
       // ============================================================================
-      isPathInScope(path310, scope) {
+      isPathInScope(path62, scope) {
         if (scope.targetFiles && scope.targetFiles.length > 0) {
           return scope.targetFiles.some(
-            (target) => path310 === target || path310.endsWith(target) || this.matchGlob(path310, target)
+            (target) => path62 === target || path62.endsWith(target) || this.matchGlob(path62, target)
           );
         }
-        return scope.allowedPaths.some((pattern) => this.matchGlob(path310, pattern));
+        return scope.allowedPaths.some((pattern) => this.matchGlob(path62, pattern));
       }
-      isPathExcluded(path310, scope) {
-        return scope.excludedPaths.some((pattern) => this.matchGlob(path310, pattern));
+      isPathExcluded(path62, scope) {
+        return scope.excludedPaths.some((pattern) => this.matchGlob(path62, pattern));
       }
-      matchesSensitivePattern(path310, policy) {
-        return policy.sensitivePatterns.some((pattern) => this.matchGlob(path310, pattern));
+      matchesSensitivePattern(path62, policy) {
+        return policy.sensitivePatterns.some((pattern) => this.matchGlob(path62, pattern));
       }
-      matchGlob(path310, pattern) {
-        const normalizedPath = path310.replace(/\\/g, "/");
+      matchGlob(path62, pattern) {
+        const normalizedPath = path62.replace(/\\/g, "/");
         const normalizedPattern = pattern.replace(/\\/g, "/");
         if (normalizedPath === normalizedPattern) return true;
         if (normalizedPattern.includes("*")) {
@@ -45341,6 +46498,15 @@ domain ${params.domainName} version "${params.version}"
       "contract-drift"
       // Contract violation
     ];
+    TIER_C_RULES = [
+      "missing-error-handling",
+      "rate-limiting-suggestion",
+      "validation-suggestion",
+      "low-confidence",
+      "excessive-claims",
+      "scope-explosion",
+      "unsafe-side-effect"
+    ];
     BaseRule = class {
       config;
       constructor(config = {}) {
@@ -45504,20 +46670,20 @@ domain ${params.domainName} version "${params.version}"
           suggestion
         );
       }
-      isExternalPath(path310) {
+      isExternalPath(path62) {
         if (!this.config.allowedExternalPaths) return false;
         return this.config.allowedExternalPaths.some(
-          (pattern) => this.matchPattern(path310, pattern)
+          (pattern) => this.matchPattern(path62, pattern)
         );
       }
       /**
        * Normalize path by removing query strings and fragments
        */
-      normalizePath(path310) {
-        return path310.split("?")[0].split("#")[0];
+      normalizePath(path62) {
+        return path62.split("?")[0].split("#")[0];
       }
-      isApiPath(path310) {
-        const normalized = this.normalizePath(path310);
+      isApiPath(path62) {
+        const normalized = this.normalizePath(path62);
         if (!this.config.apiPrefixes || this.config.apiPrefixes.length === 0) {
           return normalized.startsWith("/");
         }
@@ -45546,8 +46712,8 @@ domain ${params.domainName} version "${params.version}"
         }
         return similar.slice(0, 3);
       }
-      generateSuggestion(path310, context) {
-        const normalized = this.normalizePath(path310);
+      generateSuggestion(path62, context) {
+        const normalized = this.normalizePath(path62);
         if (context) {
           const similar = this.findSimilarRoutes(normalized, context);
           if (similar.length > 0) {
@@ -46294,6 +47460,492 @@ domain ${params.domainName} version "${params.version}"
         return "Review this code for potential security issues";
       }
     };
+    ObserveModeManager = class _ObserveModeManager {
+      state;
+      onComplete;
+      constructor(options = {}) {
+        this.state = {
+          startTime: Date.now(),
+          saveCount: 0,
+          observeDuration: options.observeDuration ?? 120,
+          observeSaveCount: options.observeSaveCount ?? 20,
+          isActive: true,
+          detectedPatterns: /* @__PURE__ */ new Map(),
+          observedViolations: [],
+          suggestedAllows: []
+        };
+        this.onComplete = options.onComplete;
+      }
+      /**
+       * Check if observe mode is still active
+       */
+      isObserving() {
+        if (!this.state.isActive) return false;
+        const elapsedSeconds = (Date.now() - this.state.startTime) / 1e3;
+        const timeExpired = elapsedSeconds >= this.state.observeDuration;
+        const savesReached = this.state.saveCount >= this.state.observeSaveCount;
+        if (timeExpired || savesReached) {
+          this.complete();
+          return false;
+        }
+        return true;
+      }
+      /**
+       * Get the remaining time/saves before observe mode ends
+       */
+      getProgress() {
+        const elapsedSeconds = (Date.now() - this.state.startTime) / 1e3;
+        const timeProgress = elapsedSeconds / this.state.observeDuration;
+        const saveProgress = this.state.saveCount / this.state.observeSaveCount;
+        const progressPercent = Math.max(timeProgress, saveProgress) * 100;
+        return {
+          elapsedSeconds: Math.round(elapsedSeconds),
+          remainingSeconds: Math.max(0, this.state.observeDuration - elapsedSeconds),
+          saveCount: this.state.saveCount,
+          remainingSaves: Math.max(0, this.state.observeSaveCount - this.state.saveCount),
+          progressPercent: Math.min(100, Math.round(progressPercent))
+        };
+      }
+      /**
+       * Record a save event during observation
+       */
+      recordSave(filePath) {
+        if (!this.state.isActive) return;
+        this.state.saveCount++;
+        this.detectFilePatterns(filePath);
+        this.isObserving();
+      }
+      /**
+       * Record a violation that was observed (not blocked) during learning
+       */
+      recordViolation(violation) {
+        if (!this.state.isActive) return;
+        this.state.observedViolations.push(violation);
+        this.analyzeViolationForPatterns(violation);
+      }
+      /**
+       * Record a code pattern observed during a save
+       */
+      recordPattern(type, pattern, filePath, regex) {
+        if (!this.state.isActive) return;
+        const key = `${type}:${pattern}`;
+        const existing = this.state.detectedPatterns.get(key);
+        if (existing) {
+          existing.count++;
+          existing.lastSeen = Date.now();
+          if (!existing.files.includes(filePath)) {
+            existing.files.push(filePath);
+          }
+          if (existing.count >= 3) {
+            existing.suggestedAllow = true;
+          }
+        } else {
+          this.state.detectedPatterns.set(key, {
+            type,
+            pattern,
+            regex,
+            count: 1,
+            firstSeen: Date.now(),
+            lastSeen: Date.now(),
+            files: [filePath],
+            suggestedAllow: false
+          });
+        }
+      }
+      /**
+       * Get current suggested allows based on observations
+       */
+      getSuggestedAllows() {
+        return this.state.suggestedAllows;
+      }
+      /**
+       * Get observed violations (would have blocked but didn't)
+       */
+      getObservedViolations() {
+        return this.state.observedViolations;
+      }
+      /**
+       * Complete observe mode and generate final suggestions
+       */
+      complete() {
+        if (!this.state.isActive) return;
+        this.state.isActive = false;
+        this.generateSuggestedAllows();
+        if (this.onComplete) {
+          this.onComplete(this.state.suggestedAllows);
+        }
+      }
+      /**
+       * Detect patterns from file paths
+       */
+      detectFilePatterns(filePath) {
+        if (filePath.includes(".gen.") || filePath.includes("generated/")) {
+          this.recordPattern("generated_file", filePath.replace(/[^/]+$/, "*"), filePath);
+        }
+        const aliasMatch = filePath.match(/^@([^/]+)/);
+        if (aliasMatch) {
+          this.recordPattern("path_alias", `@${aliasMatch[1]}/*`, filePath);
+        }
+      }
+      /**
+       * Analyze violations for learnable patterns
+       */
+      analyzeViolationForPatterns(violation) {
+        const evidence = violation.evidence;
+        if (violation.rule === "ghost-route" && evidence.includes("${")) {
+          const dynamicMatch = evidence.match(/\/api\/[^/]*\$\{[^}]+\}/);
+          if (dynamicMatch) {
+            this.recordPattern(
+              "dynamic_route",
+              dynamicMatch[0],
+              violation.filePath ?? "",
+              "^/api/[a-z]+/\\${[^}]+}$"
+            );
+          }
+        }
+        if (violation.rule === "ghost-route") {
+          const wrapperMatch = evidence.match(/(api|client|fetch|axios)\.[a-z]+\s*\(['"]([^'"]+)/i);
+          if (wrapperMatch) {
+            this.recordPattern(
+              "api_wrapper",
+              wrapperMatch[2],
+              violation.filePath ?? ""
+            );
+          }
+        }
+        if (violation.rule === "ghost-env") {
+          const envMatch = evidence.match(/([A-Z]+_)/);
+          if (envMatch) {
+            const prefix = envMatch[1];
+            if (prefix.length <= 10) {
+              this.recordPattern(
+                "env_prefix",
+                `${prefix}*`,
+                violation.filePath ?? "",
+                `^${prefix}[A-Z_]+$`
+              );
+            }
+          }
+        }
+      }
+      /**
+       * Generate final suggested allows from detected patterns
+       */
+      generateSuggestedAllows() {
+        const allows = [];
+        for (const [, pattern] of this.state.detectedPatterns) {
+          if (!pattern.suggestedAllow && pattern.count < 2) continue;
+          let type;
+          switch (pattern.type) {
+            case "dynamic_route":
+              type = "dynamic_route";
+              break;
+            case "api_wrapper":
+            case "framework_pattern":
+              type = "route_prefix";
+              break;
+            case "env_prefix":
+              type = "env_var";
+              break;
+            case "generated_file":
+            case "path_alias":
+              type = "ignored_path";
+              break;
+            default:
+              continue;
+          }
+          allows.push({
+            type,
+            pattern: pattern.pattern,
+            regex: pattern.regex,
+            confidence: Math.min(1, pattern.count / 5),
+            reason: `Seen ${pattern.count} times in ${pattern.files.length} files`,
+            seenCount: pattern.count
+          });
+        }
+        allows.sort((a, b) => b.confidence - a.confidence);
+        this.state.suggestedAllows = allows;
+      }
+      /**
+       * Force complete observe mode early
+       */
+      forceComplete() {
+        this.complete();
+        return this.state.suggestedAllows;
+      }
+      /**
+       * Reset observe mode to start fresh
+       */
+      reset() {
+        this.state = {
+          startTime: Date.now(),
+          saveCount: 0,
+          observeDuration: this.state.observeDuration,
+          observeSaveCount: this.state.observeSaveCount,
+          isActive: true,
+          detectedPatterns: /* @__PURE__ */ new Map(),
+          observedViolations: [],
+          suggestedAllows: []
+        };
+      }
+      /**
+       * Serialize state for persistence
+       */
+      toJSON() {
+        return {
+          startTime: this.state.startTime,
+          saveCount: this.state.saveCount,
+          observeDuration: this.state.observeDuration,
+          observeSaveCount: this.state.observeSaveCount,
+          isActive: this.state.isActive,
+          detectedPatterns: Array.from(this.state.detectedPatterns.entries()),
+          observedViolations: this.state.observedViolations,
+          suggestedAllows: this.state.suggestedAllows
+        };
+      }
+      /**
+       * Restore state from persisted data
+       */
+      static fromJSON(data) {
+        const manager = new _ObserveModeManager({
+          observeDuration: data.observeDuration,
+          observeSaveCount: data.observeSaveCount
+        });
+        manager.state.startTime = data.startTime;
+        manager.state.saveCount = data.saveCount;
+        manager.state.isActive = data.isActive;
+        manager.state.observedViolations = data.observedViolations;
+        manager.state.suggestedAllows = data.suggestedAllows;
+        if (Array.isArray(data.detectedPatterns)) {
+          manager.state.detectedPatterns = new Map(data.detectedPatterns);
+        }
+        return manager;
+      }
+    };
+    DEFAULT_ALLOWLIST = {
+      allowedRoutePrefixes: [],
+      allowedDynamicRoutes: [],
+      ignoredPaths: [
+        "**/node_modules/**",
+        "**/.git/**",
+        "**/dist/**",
+        "**/build/**",
+        "**/*.gen.ts",
+        "**/*.generated.*"
+      ],
+      allowedEnvVars: []
+    };
+    ALLOWLIST_FILENAME = "firewall.allow.json";
+    AllowlistManager = class {
+      allowlist;
+      projectRoot;
+      loaded = false;
+      constructor(projectRoot) {
+        this.projectRoot = projectRoot;
+        this.allowlist = { ...DEFAULT_ALLOWLIST };
+      }
+      /**
+       * Get the path to the allowlist file
+       */
+      get filePath() {
+        return path18.join(this.projectRoot, ".vibecheck", ALLOWLIST_FILENAME);
+      }
+      /**
+       * Load the allowlist from disk
+       */
+      async load() {
+        try {
+          const content = await fs102.readFile(this.filePath, "utf-8");
+          const parsed = JSON.parse(content);
+          this.allowlist = {
+            allowedRoutePrefixes: parsed.allowedRoutePrefixes ?? [],
+            allowedDynamicRoutes: parsed.allowedDynamicRoutes ?? [],
+            ignoredPaths: parsed.ignoredPaths ?? DEFAULT_ALLOWLIST.ignoredPaths,
+            allowedEnvVars: parsed.allowedEnvVars ?? [],
+            _autoGenerated: parsed._autoGenerated
+          };
+          this.loaded = true;
+        } catch {
+          this.allowlist = { ...DEFAULT_ALLOWLIST };
+          this.loaded = true;
+        }
+        return this.allowlist;
+      }
+      /**
+       * Save the allowlist to disk
+       */
+      async save() {
+        const dir = path18.dirname(this.filePath);
+        try {
+          await fs102.mkdir(dir, { recursive: true });
+        } catch {
+        }
+        const content = JSON.stringify(this.allowlist, null, 2);
+        await fs102.writeFile(this.filePath, content, "utf-8");
+      }
+      /**
+       * Get the current allowlist
+       */
+      get() {
+        return this.allowlist;
+      }
+      /**
+       * Check if a route is allowed
+       */
+      isRouteAllowed(routePath) {
+        for (const prefix of this.allowlist.allowedRoutePrefixes) {
+          if (routePath.startsWith(prefix)) {
+            return true;
+          }
+        }
+        for (const pattern of this.allowlist.allowedDynamicRoutes) {
+          try {
+            const regex = new RegExp(pattern);
+            if (regex.test(routePath)) {
+              return true;
+            }
+          } catch {
+          }
+        }
+        return false;
+      }
+      /**
+       * Check if a file path should be ignored
+       */
+      isPathIgnored(filePath) {
+        const normalized = filePath.replace(/\\/g, "/");
+        for (const pattern of this.allowlist.ignoredPaths) {
+          if (this.matchGlob(normalized, pattern)) {
+            return true;
+          }
+        }
+        return false;
+      }
+      /**
+       * Check if an env var is allowed
+       */
+      isEnvVarAllowed(varName) {
+        for (const allowed of this.allowlist.allowedEnvVars) {
+          if (allowed.endsWith("*")) {
+            const prefix = allowed.slice(0, -1);
+            if (varName.startsWith(prefix)) {
+              return true;
+            }
+          } else if (varName === allowed) {
+            return true;
+          }
+        }
+        return false;
+      }
+      /**
+       * Add a route prefix to the allowlist
+       */
+      async addRoutePrefix(prefix) {
+        if (!this.allowlist.allowedRoutePrefixes.includes(prefix)) {
+          this.allowlist.allowedRoutePrefixes.push(prefix);
+          await this.save();
+        }
+      }
+      /**
+       * Add a dynamic route pattern to the allowlist
+       */
+      async addDynamicRoute(pattern) {
+        try {
+          new RegExp(pattern);
+        } catch {
+          throw new Error(`Invalid regex pattern: ${pattern}`);
+        }
+        if (!this.allowlist.allowedDynamicRoutes.includes(pattern)) {
+          this.allowlist.allowedDynamicRoutes.push(pattern);
+          await this.save();
+        }
+      }
+      /**
+       * Add an ignored path pattern
+       */
+      async addIgnoredPath(pattern) {
+        if (!this.allowlist.ignoredPaths.includes(pattern)) {
+          this.allowlist.ignoredPaths.push(pattern);
+          await this.save();
+        }
+      }
+      /**
+       * Add an allowed env var
+       */
+      async addEnvVar(varName) {
+        if (!this.allowlist.allowedEnvVars.includes(varName)) {
+          this.allowlist.allowedEnvVars.push(varName);
+          await this.save();
+        }
+      }
+      /**
+       * Remove a route prefix from the allowlist
+       */
+      async removeRoutePrefix(prefix) {
+        const index = this.allowlist.allowedRoutePrefixes.indexOf(prefix);
+        if (index !== -1) {
+          this.allowlist.allowedRoutePrefixes.splice(index, 1);
+          await this.save();
+        }
+      }
+      /**
+       * Add entries from observe mode suggestions
+       */
+      async addFromObserveMode(suggestions) {
+        for (const suggestion of suggestions) {
+          switch (suggestion.type) {
+            case "route_prefix":
+              if (!this.allowlist.allowedRoutePrefixes.includes(suggestion.pattern)) {
+                this.allowlist.allowedRoutePrefixes.push(suggestion.pattern);
+              }
+              break;
+            case "dynamic_route":
+              if (!this.allowlist.allowedDynamicRoutes.includes(suggestion.pattern)) {
+                this.allowlist.allowedDynamicRoutes.push(suggestion.pattern);
+              }
+              break;
+            case "env_var":
+              if (!this.allowlist.allowedEnvVars.includes(suggestion.pattern)) {
+                this.allowlist.allowedEnvVars.push(suggestion.pattern);
+              }
+              break;
+            case "ignored_path":
+              if (!this.allowlist.ignoredPaths.includes(suggestion.pattern)) {
+                this.allowlist.ignoredPaths.push(suggestion.pattern);
+              }
+              break;
+          }
+        }
+        this.allowlist._autoGenerated = {
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          entries: suggestions.map((s) => ({
+            type: s.type,
+            pattern: s.pattern,
+            reason: s.reason
+          }))
+        };
+        await this.save();
+      }
+      /**
+       * Clear auto-generated entries after user review
+       */
+      async clearAutoGenerated() {
+        delete this.allowlist._autoGenerated;
+        await this.save();
+      }
+      /**
+       * Simple glob matching (supports ** and *)
+       */
+      matchGlob(path62, pattern) {
+        let regexStr = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "{{DOUBLE_STAR}}").replace(/\*/g, "[^/]*").replace(/{{DOUBLE_STAR}}/g, ".*");
+        regexStr = `^${regexStr}$`;
+        try {
+          return new RegExp(regexStr).test(path62);
+        } catch {
+          return false;
+        }
+      }
+    };
   }
 });
 function createQuickChain(claim, verified, source, details) {
@@ -46559,6 +48211,121 @@ async function resetVerificationEngine() {
     globalEngine = null;
   }
 }
+function sanitizeCode(code) {
+  let sanitized = code;
+  sanitized = sanitized.replace(/\beval\s*\(/g, '(function(){throw new Error("Security violation: eval removed")})(');
+  sanitized = sanitized.replace(/new\s+Function\s*\(/g, "/* REMOVED: Function constructor */ undefined(");
+  const secretPatterns = [
+    /(?:api[_-]?key|apikey)\s*[:=]\s*["'`]([A-Za-z0-9_\-]{20,})["'`]/gi,
+    /(?:secret|password|passwd|pwd)\s*[:=]\s*["'`]([^"'`]{8,})["'`]/gi,
+    /(?:token)\s*[:=]\s*["'`]([A-Za-z0-9_\-\.]{20,})["'`]/gi
+  ];
+  for (const pattern of secretPatterns) {
+    sanitized = sanitized.replace(pattern, (match) => {
+      if (match.includes("process.env") || match.includes("import.meta.env")) {
+        return match;
+      }
+      if (match.toLowerCase().includes("example") || match.toLowerCase().includes("placeholder")) {
+        return match;
+      }
+      const keyMatch = match.match(/^([a-z_]+)\s*[:=]/i);
+      const envKey = keyMatch ? keyMatch[1].toUpperCase().replace(/[^A-Z0-9]/g, "_") : "SECRET";
+      return `${keyMatch ? keyMatch[1] + " = " : ""}process.env.${envKey}`;
+    });
+  }
+  sanitized = sanitized.replace(/from\s+["'`]https?:\/\/[^"'`]+["'`]/g, 'from "/* REMOVED: HTTP import */"');
+  return sanitized;
+}
+async function validateAndSanitizeFiles(files, config) {
+  const validator = await getCodeValidator(config);
+  const validFiles = [];
+  const errors = [];
+  const warnings = [];
+  for (const file2 of files) {
+    if (file2.path.includes("..") || file2.path.startsWith("/")) {
+      errors.push({
+        filePath: file2.path,
+        type: "invalid_path",
+        message: "Path traversal or absolute path detected"
+      });
+      continue;
+    }
+    const validExtensions = /\.(ts|tsx|js|jsx|json|md|sql|yaml|yml|css|scss|html|txt|sh|env)$/i;
+    if (!validExtensions.test(file2.path) && !file2.path.toLowerCase().includes("dockerfile")) {
+      errors.push({
+        filePath: file2.path,
+        type: "invalid_path",
+        message: `Invalid file extension: ${file2.path}`
+      });
+      continue;
+    }
+    if (["typescript", "javascript"].includes(file2.language) || /\.(ts|tsx|js|jsx)$/i.test(file2.path)) {
+      const result = await validator.validate(file2.content, file2.path);
+      for (const error of result.errors) {
+        errors.push({
+          filePath: file2.path,
+          type: error.type,
+          message: error.message
+        });
+      }
+      for (const warning of result.warnings) {
+        warnings.push({
+          filePath: file2.path,
+          message: warning.message
+        });
+      }
+      const hasSecurityIssues = result.warnings.some((w) => w.type === "security");
+      const hasCriticalErrors = result.errors.some((e) => e.severity === "critical");
+      if (hasSecurityIssues || hasCriticalErrors) {
+        const sanitizedContent = sanitizeCode(file2.content);
+        validFiles.push({
+          ...file2,
+          content: sanitizedContent,
+          description: `${file2.description} (sanitized)`
+        });
+      } else {
+        validFiles.push(file2);
+      }
+    } else {
+      validFiles.push(file2);
+    }
+  }
+  const issueCount = errors.length + warnings.length;
+  let qualityScore = 100 - issueCount * 5;
+  qualityScore = Math.max(0, Math.min(100, qualityScore));
+  const criticalErrors = errors.filter(
+    (e) => e.type === "security" || e.type === "syntax" || e.type === "invalid_path"
+  );
+  const isProductionReady = criticalErrors.length === 0 && validFiles.length > 0;
+  return {
+    validFiles,
+    errors,
+    warnings,
+    qualityScore,
+    isProductionReady
+  };
+}
+async function calculateShipScore2(files, config) {
+  const result = await validateAndSanitizeFiles(files, config);
+  const issues = [
+    ...result.errors.map((e) => `[ERROR] ${e.filePath}: ${e.message}`),
+    ...result.warnings.map((w) => `[WARN] ${w.filePath}: ${w.message}`)
+  ];
+  let verdict;
+  if (result.qualityScore >= 80 && result.isProductionReady) {
+    verdict = "SHIP";
+  } else if (result.qualityScore >= 60) {
+    verdict = "WARN";
+  } else {
+    verdict = "BLOCK";
+  }
+  return {
+    score: result.qualityScore,
+    verdict,
+    issues,
+    isProductionReady: result.isProductionReady
+  };
+}
 async function getCodeValidator(config) {
   if (!globalValidator) {
     globalValidator = new CodeValidator(config);
@@ -46573,8 +48340,8 @@ function getDriftDetector(config) {
   return globalDetector;
 }
 var DEFAULT_CONFIG11, BUILTIN_TYPES, WELLKNOWN_ENV, HallucinationDetector, SOURCE_RELIABILITY, DEFAULT_VERIFIER_CONFIG, DEFAULT_CALIBRATION_CONFIG, DEFAULT_CONFIG26, EvidenceChainBuilder, truthpackCache, truthpackVerifier, BUILTIN_MODULES2, packageJsonCache, packageJsonVerifier, filesystemVerifier, astVerifier, gitVerifier, typescriptVerifier, runtimeVerifier, ALL_VERIFIERS, DEFAULT_CONFIG35, ConfidenceCalibrator, globalCalibrator, DEFAULT_CONFIG45, VerificationEngine, globalEngine, DEFAULT_CONFIG55, MultiSourceVerifier, DEFAULT_CONFIG64, KNOWN_PACKAGES, HALLUCINATION_PATTERNS, SECURITY_PATTERNS2, CodeValidator, globalValidator, SAFETY_LIMITS2, DEFAULT_CONFIG73, ROUTE_FRAMEWORKS, DriftDetector, globalDetector;
-var init_chunk_RPKCC72C = __esm({
-  "../../packages/core/dist/chunk-RPKCC72C.js"() {
+var init_chunk_WS67ECG2 = __esm({
+  "../../packages/core/dist/chunk-WS67ECG2.js"() {
     init_chunk_A4CYIMGM();
     init_chunk_SKXQ6JUA();
     init_chunk_4EQXFW4J();
@@ -48682,16 +50449,38 @@ var init_chunk_RPKCC72C = __esm({
       { pattern: /return\s+(?:null|undefined|{});\s*\/\/\s*placeholder/gi, type: "invented_pattern" }
     ];
     SECURITY_PATTERNS2 = [
+      // Critical: Code execution
       { pattern: /eval\s*\(/g, message: "Avoid eval() - it can execute arbitrary code", severity: "critical" },
       { pattern: /new\s+Function\s*\(/g, message: "Avoid new Function() - similar risks to eval()", severity: "critical" },
+      { pattern: /\bsetTimeout\s*\(\s*["'`]/g, message: "setTimeout with string argument is dangerous", severity: "critical" },
+      { pattern: /\bsetInterval\s*\(\s*["'`]/g, message: "setInterval with string argument is dangerous", severity: "critical" },
+      // High: XSS and injection
       { pattern: /innerHTML\s*=/g, message: "innerHTML can lead to XSS - use textContent or sanitize", severity: "high" },
       { pattern: /document\.write\s*\(/g, message: "document.write is dangerous and deprecated", severity: "high" },
       { pattern: /dangerouslySetInnerHTML/g, message: "dangerouslySetInnerHTML can lead to XSS", severity: "medium" },
+      { pattern: /\bchild_process\s*\.\s*exec\s*\(/g, message: "child_process.exec() can be dangerous - use execFile", severity: "high" },
+      { pattern: /\bchild_process\s*\.\s*execSync\s*\(/g, message: "child_process.execSync() can be dangerous", severity: "high" },
+      // Critical: Secrets
       { pattern: /(?:password|secret|api_key|apikey|token)\s*[:=]\s*['"`][^'"`]{8,}['"`]/gi, message: "Potential hardcoded secret detected", severity: "critical" },
+      { pattern: /sk[-_](?:live|test)[-_][A-Za-z0-9]{20,}/g, message: "Stripe secret key detected", severity: "critical" },
+      { pattern: /ghp_[A-Za-z0-9]{36,}/g, message: "GitHub personal access token detected", severity: "critical" },
+      { pattern: /github_pat_[A-Za-z0-9_]{22,}/g, message: "GitHub fine-grained token detected", severity: "critical" },
+      { pattern: /xox[baprs]-[A-Za-z0-9\-]{10,}/g, message: "Slack token detected", severity: "critical" },
+      { pattern: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/g, message: "Private key detected in code", severity: "critical" },
+      { pattern: /AKIA[A-Z0-9]{16}/g, message: "AWS access key detected", severity: "critical" },
+      // Critical: Injection
       { pattern: /(?:SELECT|INSERT|UPDATE|DELETE).*\+.*(?:req\.|params\.|query\.)/gi, message: "Potential SQL injection - use parameterized queries", severity: "critical" },
       { pattern: /\$\{.*(?:req\.|params\.|query\.).*\}/g, message: "Template literal with user input - potential injection", severity: "high" },
       { pattern: /exec\s*\(\s*(?:req\.|params\.|query\.)/g, message: "Command injection risk - sanitize input", severity: "critical" },
-      { pattern: /\.createReadStream\s*\(\s*(?:req\.|params\.|query\.)/g, message: "Path traversal risk - validate file paths", severity: "high" }
+      { pattern: /\.createReadStream\s*\(\s*(?:req\.|params\.|query\.)/g, message: "Path traversal risk - validate file paths", severity: "high" },
+      // High: Dynamic imports
+      { pattern: /\brequire\s*\(\s*[^"'`\s]/g, message: "Dynamic require is dangerous", severity: "high" },
+      { pattern: /\b__dirname\s*\+\s*[^"'`]/g, message: "Dynamic path construction can be dangerous", severity: "high" },
+      { pattern: /from\s+["'`]https?:\/\//g, message: "HTTP import detected - use npm packages", severity: "high" },
+      { pattern: /import\s*\(\s*["'`]https?:\/\//g, message: "Dynamic HTTP import detected", severity: "high" },
+      // Medium: Destructive operations
+      { pattern: /\bfs\s*\.\s*(?:unlink|rmdir|rm)Sync?\s*\(/g, message: "Destructive file operation detected", severity: "medium" },
+      { pattern: /\bprocess\.exit\s*\(/g, message: "process.exit() detected - may cause unexpected termination", severity: "medium" }
     ];
     CodeValidator = class {
       config;
@@ -60529,6 +62318,7 @@ __export(dist_exports, {
   AdvancedContextManager: () => AdvancedContextManager,
   AdvancedScanner: () => AdvancedScanner,
   AgentFirewall: () => AgentFirewall,
+  AllowlistManager: () => AllowlistManager,
   ArchitectAgent: () => ArchitectAgent,
   AuditLogger: () => AuditLogger,
   AuthDriftRule: () => AuthDriftRule,
@@ -60578,7 +62368,9 @@ __export(dist_exports, {
   ContextSync: () => ContextSync,
   ContextValidator: () => ContextValidator,
   ContractDriftRule: () => ContractDriftRule,
+  ContractGenerator: () => ContractGenerator,
   ContractScanner: () => ContractScanner,
+  ContractVerifier: () => ContractVerifier,
   ContractsSchema: () => ContractsSchema2,
   DARK_THEME_CSS: () => DARK_THEME_CSS,
   DARK_THEME_VARS: () => DARK_THEME_VARS,
@@ -60712,6 +62504,7 @@ __export(dist_exports, {
   MultiLevelCache: () => MultiLevelCache,
   MultiSourceVerifier: () => MultiSourceVerifier,
   NODE_TYPE_COLORS: () => NODE_TYPE_COLORS,
+  ObserveModeManager: () => ObserveModeManager,
   Orchestrator: () => Orchestrator,
   PATTERNS: () => PATTERNS,
   PHASE_RULE_CONFIGS: () => PHASE_RULE_CONFIGS,
@@ -60784,7 +62577,10 @@ __export(dist_exports, {
   SkillsLoader: () => SkillsLoader,
   SsrfGuard: () => SsrfGuard,
   TEST_CONTEXT_PATTERNS: () => TEST_CONTEXT_PATTERNS,
+  TIER_A_RULES: () => TIER_A_RULES,
+  TIER_B_RULES: () => TIER_B_RULES,
   TIER_CONFIGS: () => TIER_CONFIGS,
+  TIER_C_RULES: () => TIER_C_RULES,
   TIER_INFO: () => TIER_INFO,
   TOOL_NAME: () => TOOL_NAME,
   TOOL_URI: () => TOOL_URI,
@@ -60797,6 +62593,7 @@ __export(dist_exports, {
   TranslatorAssumption: () => TranslatorAssumption,
   TranslatorOutput: () => TranslatorOutput,
   TranslatorQuestion: () => TranslatorQuestion,
+  TrustScorer: () => TrustScorer,
   TruthpackGenerator: () => TruthpackGenerator,
   TruthpackValidators: () => TruthpackValidators,
   UPGRADE_TRIGGERS: () => UPGRADE_TRIGGERS,
@@ -60857,7 +62654,6 @@ __export(dist_exports, {
   calculateScoreFromCounts: () => calculateScoreFromCounts,
   calculateScoreFromPassRate: () => calculateScoreFromPassRate,
   calculateSecurityScore: () => calculateSecurityScore,
-  calculateShipScore: () => calculateShipScore,
   calculateWorkerCount: () => calculateWorkerCount,
   checkCommandAccess: () => checkCommandAccess,
   checkConfig: () => checkConfig,
@@ -60889,6 +62685,7 @@ __export(dist_exports, {
   createActionClassifier: () => createActionClassifier,
   createAggressiveModeManager: () => createAggressiveModeManager,
   createAllowlistFix: () => createAllowlistFix,
+  createAllowlistManager: () => createAllowlistManager,
   createBadgeGenerator: () => createBadgeGenerator,
   createBatchDetector: () => createBatchDetector,
   createCacheKey: () => createCacheKey,
@@ -60920,6 +62717,7 @@ __export(dist_exports, {
   createLearningStorage: () => createLearningStorage,
   createLearningSystem: () => createLearningSystem,
   createMissionGrouper: () => createMissionGrouper,
+  createObserveModeManager: () => createObserveModeManager,
   createParallelAnalyzer: () => createParallelAnalyzer,
   createPluginLoader: () => createPluginLoader,
   createPluginManager: () => createPluginManager,
@@ -60943,6 +62741,7 @@ __export(dist_exports, {
   createSsrfGuard: () => createSsrfGuard,
   createTelemetryService: () => createTelemetryService,
   createTempFile: () => createTempFile,
+  createTieredViolation: () => createTieredViolation,
   createTimeoutManager: () => createTimeoutManager,
   createUrlAllowlist: () => createUrlAllowlist,
   createVideoStorageService: () => createVideoStorageService,
@@ -60999,7 +62798,6 @@ __export(dist_exports, {
   findReferencedVariables: () => findReferencedVariables,
   findRelevantTemplates: () => findRelevantTemplates,
   findRunningServer: () => findRunningServer,
-  findSimilar: () => findSimilar2,
   findUnusedFunctions: () => findUnusedFunctions,
   findingToSarifResult: () => findingToSarifResult,
   fingerprint: () => fingerprint,
@@ -61017,6 +62815,7 @@ __export(dist_exports, {
   formatMetrics: () => formatMetrics,
   formatNumber: () => formatNumber,
   formatProgress: () => formatProgress,
+  formatProofBundle: () => formatProofBundle,
   formatReceipt: () => formatReceipt,
   formatReceiptSummary: () => formatReceiptSummary,
   formatScanReport: () => formatScanReport,
@@ -61028,6 +62827,7 @@ __export(dist_exports, {
   formatTierBadge: () => formatTierBadge,
   formatUpgradePrompt: () => formatUpgradePrompt,
   formatVerdict: () => formatVerdict,
+  formatViolationMessage: () => formatViolationMessage,
   gateFeature: () => gateFeature,
   generateAIContract: () => generateAIContract,
   generateAuditId: () => generateAuditId,
@@ -61055,6 +62855,7 @@ __export(dist_exports, {
   generatePRWorkflow: () => generatePRWorkflow,
   generatePdfBuffer: () => generatePdfBuffer,
   generatePdfReport: () => generatePdfReport,
+  generateProofBundle: () => generateProofBundle,
   generateRealityCheckPdf: () => generateRealityCheckPdf,
   generateRealityCheckReport: () => generateRealityCheckReport,
   generateReceipt: () => generateReceipt,
@@ -61085,6 +62886,7 @@ __export(dist_exports, {
   getCheckpointAge: () => getCheckpointAge,
   getCircuitBreaker: () => getCircuitBreaker,
   getClaimExtractor: () => getClaimExtractor,
+  getCodeValidator: () => getCodeValidator,
   getCommand: () => getCommand,
   getCommandsByCategory: () => getCommandsByCategory,
   getCommandsByTier: () => getCommandsByTier,
@@ -61191,6 +62993,7 @@ __export(dist_exports, {
   htmlToPdf: () => htmlToPdf,
   initTempCleanup: () => initTempCleanup,
   invalidateCache: () => invalidateCache,
+  isAllowed: () => isAllowed,
   isBlockedIp: () => isBlockedIp,
   isCategoryRelevantForPhase: () => isCategoryRelevantForPhase,
   isConfidenceLevel: () => isConfidenceLevel,
@@ -61334,6 +63137,7 @@ __export(dist_exports, {
   runWithConcurrency: () => runWithConcurrency,
   runtimeVerifier: () => runtimeVerifier,
   sanitize: () => sanitize,
+  sanitizeCode: () => sanitizeCode,
   sanitizeFilePath: () => sanitizeFilePath,
   sarifToJson: () => sarifToJson,
   scanCodeQuality: () => scanCodeQuality,
@@ -61380,6 +63184,7 @@ __export(dist_exports, {
   unregisterCommand: () => unregisterCommand,
   unregisterTempFile: () => unregisterTempFile,
   updateManifest: () => updateManifest,
+  validateAndSanitizeFiles: () => validateAndSanitizeFiles,
   validateCallAgainstImports: () => validateCallAgainstImports,
   validateContract: () => validateContract,
   validateIssue: () => validateIssue,
@@ -61389,6 +63194,7 @@ __export(dist_exports, {
   validateRule: () => validateRule,
   validateTranslatorOutput: () => validateTranslatorOutput,
   verdictToBadgeStatus: () => verdictToBadgeStatus,
+  verifyProofBundle: () => verifyProofBundle,
   verifyReceipt: () => verifyReceipt,
   verifyReceiptSignature: () => verifyReceiptSignature,
   visualizePath: () => visualizePath,
@@ -68210,24 +70016,25 @@ var init_dist3 = __esm({
     init_chunk_BQ2JBTLZ();
     init_chunk_DJEFLCF2();
     init_chunk_KVOEVY4C();
-    init_chunk_VCXA3YAU();
+    init_chunk_GXXYXSWF();
     init_chunk_C6QLUUAJ();
     init_chunk_KCZC5WTF();
     init_chunk_HUPNY5JN();
     init_chunk_NUMYYREJ();
     init_chunk_2D2X5IRQ();
     init_chunk_F5SN54L7();
-    init_chunk_QJNHJVEI();
+    init_chunk_GZFCACMG();
     init_chunk_3T7PUIDN();
     init_chunk_BXUMCGJG();
     init_chunk_ENJMGXRB();
     init_chunk_ENJMGXRB();
     init_chunk_VB6M3WM5();
     init_chunk_VB6M3WM5();
-    init_chunk_YK33YEF4();
+    init_chunk_4MEEGNJS();
+    init_chunk_4MEEGNJS();
     init_chunk_DFJL4MLU();
-    init_chunk_RPKCC72C();
-    init_chunk_RPKCC72C();
+    init_chunk_WS67ECG2();
+    init_chunk_WS67ECG2();
     init_chunk_A4CYIMGM();
     init_chunk_SKXQ6JUA();
     init_chunk_4EQXFW4J();
@@ -73864,6 +75671,8 @@ ${content}`;
       codeValidator = null;
       driftDetector = null;
       mockDetectorScanner = null;
+      contractVerifier = null;
+      truthpackGenerator = null;
       initialized = false;
       constructor(options) {
         this.options = { ...DEFAULT_OPTIONS7, ...options };
@@ -73931,6 +75740,28 @@ ${content}`;
             })()
           );
         }
+        initPromises.push(
+          (async () => {
+            this.contractVerifier = new ContractVerifier({
+              projectRoot: this.options.projectRoot,
+              strict: false
+            });
+            await this.contractVerifier.loadContracts();
+            this.truthpackGenerator = new TruthpackGenerator({
+              projectRoot: this.options.projectRoot,
+              outputDir: path18.join(this.options.projectRoot, ".vibecheck", "truthpack"),
+              scanners: {
+                routes: true,
+                env: true,
+                auth: true,
+                contracts: true,
+                uiGraph: false
+              },
+              watchMode: false,
+              watchDebounceMs: 1e3
+            });
+          })()
+        );
         await Promise.all(initPromises);
         this.initialized = true;
         const initTime = Date.now() - startTime;
@@ -74069,6 +75900,47 @@ ${content}`;
             error: mockDetection.summary.bySeverity.error
           });
         }
+        let contractVerification;
+        if (this.contractVerifier) {
+          this.logger.debug("Starting contract verification");
+          let truthpackContext;
+          if (this.truthpackGenerator) {
+            try {
+              const truthpack = await this.truthpackGenerator.generate();
+              truthpackContext = this.contractVerifier.createContext({
+                routes: truthpack.routes,
+                env: truthpack.env,
+                auth: truthpack.auth
+              });
+            } catch {
+              truthpackContext = this.contractVerifier.createContext();
+            }
+          }
+          contractVerification = await this.contractVerifier.verifyAll(truthpackContext);
+          for (const violation of contractVerification.violations) {
+            findings.push({
+              id: `contract-${violation.contractName}-${violation.behaviorName ?? "unknown"}-${violation.line ?? 0}`,
+              type: this.mapViolationToType(violation.type),
+              severity: violation.severity === "error" ? "error" : violation.severity === "warning" ? "warning" : "info",
+              message: violation.message,
+              file: violation.file,
+              line: violation.line ?? null,
+              column: violation.column ?? null,
+              evidence: violation.evidence ?? [],
+              confidence: violation.confidence ?? 0.7,
+              verified: true,
+              suggestion: violation.suggestion,
+              autoFixable: violation.autoFixable,
+              category: "hallucination"
+              // Contract violations are potential hallucinations
+            });
+          }
+          this.logger.debug("Contract verification complete", {
+            verdict: contractVerification.verdict,
+            violations: contractVerification.violations.length,
+            coverage: contractVerification.coverage
+          });
+        }
         const durationMs = Date.now() - startTime;
         const metrics = {
           durationMs,
@@ -74460,6 +76332,16 @@ ${content}`;
         };
         return typeMap[category] ?? "invented_pattern";
       }
+      mapViolationToType(violationType) {
+        const typeMap = {
+          "type_mismatch": "fake_type",
+          "missing_field": "fake_type",
+          "constraint_violation": "invented_pattern",
+          "contract_drift": "type_drift",
+          "unverified_behavior": "fake_api"
+        };
+        return typeMap[violationType] ?? "invented_pattern";
+      }
       isAutoFixable(type) {
         const autoFixable = /* @__PURE__ */ new Set([
           "fake_import",
@@ -81358,10 +83240,10 @@ ${content}`;
             };
           }
         }
-        const isAllowed = this.config.allowedRoutes.some(
+        const isAllowed2 = this.config.allowedRoutes.some(
           (pattern) => this.matchesPattern(pathname, pattern)
         );
-        if (!isAllowed) {
+        if (!isAllowed2) {
           return {
             allowed: false,
             reason: "URL does not match any allowed pattern"
@@ -82349,11 +84231,13 @@ __export(scoring_exports, {
   createISLScorer: () => createISLScorer,
   createShipScoreCalculator: () => createShipScoreCalculator,
   determineVerdict: () => determineVerdict,
+  formatProofBundle: () => formatProofBundle,
   formatScore: () => formatScore,
   formatScoreOutOf100: () => formatScoreOutOf100,
   formatScorePercent: () => formatScorePercent,
   formatShipScore: () => formatShipScore,
   formatVerdict: () => formatVerdict,
+  generateProofBundle: () => generateProofBundle,
   getCategoryForEngine: () => getCategoryForEngine,
   getCategoryNames: () => getCategoryNames,
   getCategoryWeight: () => getCategoryWeight,
@@ -82364,11 +84248,12 @@ __export(scoring_exports, {
   getVerdictFromScore: () => getVerdictFromScore,
   islScorer: () => islScorer,
   shipScoreCalculator: () => shipScoreCalculator,
-  toSeverityCounts: () => toSeverityCounts
+  toSeverityCounts: () => toSeverityCounts,
+  verifyProofBundle: () => verifyProofBundle
 });
 var init_scoring = __esm({
   "../../packages/core/dist/scoring/index.js"() {
-    init_chunk_VCXA3YAU();
+    init_chunk_GXXYXSWF();
     init_chunk_RRAR6G52();
   }
 });
@@ -82379,11 +84264,15 @@ __export(validation_exports, {
   CodeValidator: () => CodeValidator,
   DriftDetector: () => DriftDetector,
   HallucinationDetector: () => HallucinationDetector,
-  MultiSourceVerifier: () => MultiSourceVerifier
+  MultiSourceVerifier: () => MultiSourceVerifier,
+  calculateShipScore: () => calculateShipScore2,
+  getCodeValidator: () => getCodeValidator,
+  sanitizeCode: () => sanitizeCode,
+  validateAndSanitizeFiles: () => validateAndSanitizeFiles
 });
 var init_validation = __esm({
   "../../packages/core/dist/validation/index.js"() {
-    init_chunk_RPKCC72C();
+    init_chunk_WS67ECG2();
     init_chunk_A4CYIMGM();
     init_chunk_SKXQ6JUA();
     init_chunk_4EQXFW4J();
@@ -83183,7 +85072,7 @@ async function configureOutput(currentConfig) {
 }
 
 // src/lib/version.ts
-var CLI_VERSION = "1.2.1" ;
+var CLI_VERSION = "1.2.2" ;
 var CLI_NAME = "vibecheck-ai" ;
 
 // src/ui/command-header.tsx
@@ -84439,11 +86328,6 @@ async function showLoginScreen() {
         label: "\u{1F4E7}  " + chalk9.white("Email & Password"),
         hint: "Classic login"
       },
-      {
-        value: "github",
-        label: "\u{1F419}  " + chalk9.white("Continue with GitHub"),
-        hint: "OAuth login"
-      },
       {
         value: "google",
         label: "\u{1F50D}  " + chalk9.white("Continue with Google"),
@@ -84474,8 +86358,6 @@ async function showLoginScreen() {
       return await apiKeyLogin();
     case "email":
       return await emailLogin();
-    case "github":
-      return await oauthLogin("GitHub");
     case "google":
       return await oauthLogin("Google");
     case "magic":
@@ -84777,7 +86659,7 @@ async function signupFlow() {
       },
       {
         value: "pro",
-        label: "\u2B50  " + chalk9.yellow("Pro") + chalk9.dim(" - $29/dev/mo"),
+        label: "\u2B50  " + chalk9.yellow("Pro") + chalk9.dim(" - $19/dev/mo"),
         hint: "Cloud sync, team collaboration, API access"
       },
       {
@@ -84837,7 +86719,7 @@ async function showLoginSuccess(session) {
   };
   const tierLabels = {
     free: "\u{1F193} Free",
-    pro: "\u2B50 Pro ($29/dev/mo)",
+    pro: "\u2B50 Pro ($19/dev/mo)",
     enterprise: "\u{1F3E2} Enterprise"
   };
   console.log("  " + chalk9.dim("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
@@ -84920,6 +86802,10 @@ async function initializeFromCredentials() {
 function getCurrentTier() {
   return currentSession.tier;
 }
+async function getCurrentTierAsync() {
+  await initializeFromCredentials();
+  return currentSession.tier;
+}
 function isAuthenticated() {
   return currentSession.authenticated;
 }
@@ -84934,6 +86820,24 @@ var EXIT_CODES = {
   TIER_GATE: 10,
   INTERRUPTED: 130
 };
+async function checkEntitlements() {
+  await initializeFromCredentials();
+  const tier = getCurrentTier();
+  const authenticated = isAuthenticated();
+  return {
+    isPro: tier === "pro" || tier === "enterprise",
+    isEnterprise: tier === "enterprise",
+    currentTier: tier,
+    authenticated
+  };
+}
+async function isPro() {
+  await initializeFromCredentials();
+  return currentSession.tier === "pro" || currentSession.tier === "enterprise";
+}
+function isProSync() {
+  return currentSession.tier === "pro" || currentSession.tier === "enterprise";
+}
 
 // src/ui/upgrade-prompt.ts
 function renderUpgradePrompt(options) {
@@ -87241,60 +89145,16 @@ async function scanCommand(options) {
   const startTime = Date.now();
   const performanceTracker = getPerformanceTracker();
   const phaseTimings = {};
-  let quotaStatus = null;
   const scanStartTime = Date.now();
   try {
     validateOptions(options);
     checkSystemRequirements();
     const isAuth = await isAuthenticatedAsync();
-    if (!isAuth) {
+    if (!isAuth && !options.quiet) {
       logger2.warn("");
       logger2.warn(chalk9.yellow("\u26A0\uFE0F  Not authenticated - scan usage cannot be tracked."));
-      logger2.warn(chalk9.gray("   Run `vibecheck login` to authenticate and track your usage."));
-      logger2.warn(chalk9.gray("   Free tier: 5 scans/month | Pro tier: Unlimited scans"));
+      logger2.warn(chalk9.gray("   Run `vibecheck login` to authenticate and sync to cloud."));
       logger2.warn("");
-    } else {
-      const quotaCheck = await checkScanAllowed();
-      if (!quotaCheck.success) {
-        if (quotaCheck.error?.code === "QUOTA_EXCEEDED") {
-          const details = quotaCheck.error.details;
-          logger2.error("");
-          logger2.error(chalk9.red("\u274C Scan quota exceeded!"));
-          logger2.error("");
-          logger2.error(chalk9.white(`   You've used all ${details?.limit ?? 5} free scans this month.`));
-          if (details?.resetsAt) {
-            const resetDate = new Date(details.resetsAt);
-            logger2.error(chalk9.gray(`   Quota resets: ${resetDate.toLocaleDateString()}`));
-          }
-          logger2.error("");
-          logger2.error(chalk9.cyan("   \u{1F680} Upgrade to Pro for unlimited scans:"));
-          logger2.error(chalk9.cyan("      https://vibecheckai.dev/pricing?action=checkout&plan=pro"));
-          logger2.error("");
-          process.exit(10);
-        } else if (quotaCheck.error?.code === "NETWORK_ERROR") {
-          logger2.warn("");
-          logger2.warn(chalk9.yellow("\u26A0\uFE0F  Could not verify scan quota (offline mode)."));
-          logger2.warn(chalk9.gray("   Scan will proceed but usage may not be tracked."));
-          logger2.warn("");
-        } else {
-          logger2.warn("");
-          logger2.warn(chalk9.yellow(`\u26A0\uFE0F  Quota check warning: ${quotaCheck.error?.message}`));
-          logger2.warn("");
-        }
-      } else if (quotaCheck.data) {
-        quotaStatus = quotaCheck.data;
-        if (quotaStatus.tier === "free" && quotaStatus.limit !== -1) {
-          const remaining = quotaStatus.remaining;
-          if (remaining <= 2) {
-            logger2.warn("");
-            logger2.warn(chalk9.yellow(`\u26A0\uFE0F  ${formatQuotaMessage(quotaStatus)}`));
-            if (remaining <= 1) {
-              logger2.warn(chalk9.gray("   Upgrade to Pro for unlimited scans: vibecheck upgrade"));
-            }
-            logger2.warn("");
-          }
-        }
-      }
     }
     const configLoadStart = Date.now();
     let config;
@@ -87544,20 +89404,17 @@ async function scanCommand(options) {
         quiet: options.quiet,
         logger: logger2
       });
-      if (!options.json && !options.quiet && userTier === "free") {
+      if (!options.json && !options.quiet && !isProSync()) {
         printForgeUpgradeSuggestion(userTier, logger2);
       }
     }
     if (await isAuthenticatedAsync()) {
       const scanDuration = Date.now() - scanStartTime;
-      const recordResult = await recordScan({
+      await recordScan({
         scanType: "full",
         projectPath: process.cwd(),
         duration: scanDuration
       });
-      if (recordResult.success && recordResult.data) {
-        quotaStatus = recordResult.data;
-      }
     }
     if (options.json) {
       const commandResult = {
@@ -87645,34 +89502,7 @@ async function scanCommand(options) {
         logger2.dim(`Size: ${formatBytes(outputSize)}`);
       }
       logger2.dim(`Duration: ${formatDuration(results.duration)}`);
-      if (quotaStatus && quotaStatus.tier === "free" && quotaStatus.limit !== -1 && !options.quiet) {
-        logger2.newline();
-        const remaining = quotaStatus.remaining;
-        const used = quotaStatus.used;
-        const limit = quotaStatus.limit;
-        if (remaining === 0) {
-          console.log(colors.error("\u2501".repeat(50)));
-          console.log(`${chalk9.red("\u26A0")} ${chalk9.bold.red("No scans remaining this month")}`);
-          console.log(colors.error("\u2501".repeat(50)));
-          console.log("");
-          console.log(chalk9.white(`   You've used all ${limit} free scans.`));
-          console.log("");
-          console.log(chalk9.cyan("   \u{1F680} Upgrade to Pro for unlimited scans:"));
-          console.log(chalk9.cyan("      vibecheck upgrade"));
-          console.log("");
-        } else if (remaining <= 2) {
-          console.log(colors.warning("\u2501".repeat(50)));
-          console.log(`${chalk9.yellow("\u26A1")} ${chalk9.bold(`${remaining} scan${remaining === 1 ? "" : "s"} remaining`)}`);
-          console.log(colors.warning("\u2501".repeat(50)));
-          console.log("");
-          console.log(chalk9.gray(`   Used: ${used}/${limit} scans this month`));
-          console.log("");
-          console.log(chalk9.cyan("   Upgrade to Pro for unlimited scans: vibecheck upgrade"));
-          console.log("");
-        } else {
-          logger2.dim(`Scans remaining: ${remaining}/${limit} this month`);
-        }
-      } else if (!isAuthenticated() && !options.quiet) {
+      if (!isAuthenticated() && !options.quiet) {
         logger2.newline();
         console.log(colors.primary("\u2501".repeat(50)));
         console.log(`${symbols.raw.star} ${chalk9.bold("Pro Features Available")}`);
@@ -88485,10 +90315,10 @@ function formatCategory(category) {
   };
   return categoryMap[category] || category;
 }
-function renderFixCTA(hasFixableIssues, isPro = false) {
+function renderFixCTA(hasFixableIssues, isPro2 = false) {
   const lines = [];
   if (hasFixableIssues) {
-    if (isPro) {
+    if (isPro2) {
       lines.push(chalk9.cyan("Fix these in 1 click: ") + chalk9.bold("vibecheck fix -i"));
     } else {
       lines.push(chalk9.cyan("Fix these in 1 click: ") + chalk9.bold("vibecheck fix -i"));
@@ -88677,7 +90507,7 @@ async function runQuickstartClean(projectRoot, showExplain) {
     console.log(`  ${chalk9.cyan("\u2022")} Video replay viewer`);
     console.log(`  ${chalk9.cyan("\u2022")} Chaos Agent for stress testing`);
     console.log("");
-    console.log(`${chalk9.dim("Start 3-day free trial:")} ${chalk9.cyan("vibecheck upgrade --trial")}`);
+    console.log(`${chalk9.dim("Start 7-day free trial:")} ${chalk9.cyan("vibecheck upgrade --trial")}`);
     console.log("");
     console.log(chalk9.bold("Next step:"));
     console.log(`  ${chalk9.cyan("vibecheck certify")} ${chalk9.dim("\u2014")} Get your first Ship Score`);
@@ -88946,7 +90776,7 @@ async function initCommand(options) {
       }
       try {
         const { TruthpackGenerator: TruthpackGenerator2 } = await Promise.resolve().then(() => (init_truthpack(), truthpack_exports));
-        const { calculateShipScore: calculateShipScore2, getTopFixableIssues: getTopFixableIssues2 } = await Promise.resolve().then(() => (init_scoring(), scoring_exports));
+        const { calculateShipScore: calculateShipScore3, getTopFixableIssues: getTopFixableIssues2 } = await Promise.resolve().then(() => (init_scoring(), scoring_exports));
         const { DriftDetector: DriftDetector2 } = await Promise.resolve().then(() => (init_validation(), validation_exports));
         const scanStartTime = Date.now();
         const generator = new TruthpackGenerator2({
@@ -88976,7 +90806,7 @@ async function initCommand(options) {
           message: item.details,
           autoFixable: true
         }));
-        const score = calculateShipScore2({
+        const score = calculateShipScore3({
           truthpack: {
             routes: truthpack.routes || [],
             env: truthpack.env?.map((e) => ({ name: e.name, required: e.required })) || [],
@@ -89126,13 +90956,12 @@ async function initCommand(options) {
       }
       console.log(JSON.stringify(jsonOutput, null, 2));
     } else if (quickModeResult) {
-      const userTier = getCurrentTier();
       console.log(renderQuickInitOutput(
         quickModeResult.score,
         quickModeResult.findings,
         duration,
         {
-          isPro: userTier === "pro" || userTier === "enterprise",
+          isPro: isProSync(),
           projectPath: process.cwd()
         }
       ));
@@ -89175,11 +91004,9 @@ async function initCommand(options) {
           console.log(`  ${symbols.info} ${instruction}`);
         }
       }
-      if (forgeResult?.ran) {
+      if (forgeResult?.ran && !isProSync()) {
         const userTier = getCurrentTier();
-        if (userTier === "free") {
-          printForgeUpgradeSuggestion(userTier, logger2);
-        }
+        printForgeUpgradeSuggestion(userTier, logger2);
       }
     }
   } catch (error) {
@@ -90814,10 +92641,9 @@ async function shipCommand(options) {
         }
       }
       if (ready && !options.quiet) {
-        const userTier = getCurrentTier();
-        const isPro = userTier === "pro" || userTier === "enterprise";
+        const isPro2 = isProSync();
         logger2.newline();
-        if (isPro && isAuthenticated()) {
+        if (isPro2 && isAuthenticated()) {
           console.log(`
 ${colors.primary("\u2501".repeat(50))}
 ${colors.success("\u2713")} ${chalk9.bold("Ship Badge Ready!")} ${colors.muted("(Pro Feature)")}
@@ -92236,8 +94062,7 @@ var DEFAULT_HTML_FILENAME = "vibecheck-report.html";
 var DEFAULT_PDF_FILENAME = "vibecheck-report.pdf";
 var PRO_REPORT_TYPES = ["executive-summary", "detailed-technical", "compliance"];
 function checkReportTierGate(options) {
-  const currentTier = getCurrentTier();
-  if (currentTier === "pro" || currentTier === "enterprise") {
+  if (isProSync()) {
     return null;
   }
   if (options.type && PRO_REPORT_TYPES.includes(options.type)) {
@@ -93169,7 +94994,6 @@ function findProjectRootSync(startDir) {
 }
 
 // src/commands/forge.ts
-init_credentials();
 function printForgeValue(logger2) {
   logger2.newline();
   logger2.info(chalk9.bold.magenta("What Forge Does For You:"));
@@ -93319,21 +95143,15 @@ var forgeCommand = new Command("forge").description("Generate AI context rules t
       logger2.error('Not in a VibeCheck project. Run "vibecheck init" first.');
       process.exit(1);
     }
-    let userTier = "free";
-    try {
-      const result = await loadCredentials();
-      if (result.valid && result.credentials) {
-        userTier = result.credentials.tier ?? "free";
-      }
-    } catch {
-    }
+    const userTier = await getCurrentTierAsync();
     const tierConfig = options.tier ? { tier: options.tier, maxRules: getTierLimit(options.tier) } : getForgeConfigForTier(userTier);
     const platforms = options.platform === "both" ? ["cursor", "windsurf"] : [options.platform ?? "cursor"];
+    const isPro2 = userTier === "pro" || userTier === "enterprise";
     const config = {
       tier: tierConfig.tier,
       maxRules: tierConfig.maxRules,
       incremental: options.incremental ?? true,
-      generateContract: options.contract ?? userTier !== "free",
+      generateContract: options.contract ?? isPro2,
       verbose: globalOpts.verbose ?? false,
       platforms
     };
@@ -93353,12 +95171,13 @@ var forgeCommand = new Command("forge").description("Generate AI context rules t
       return;
     }
     printForgeStats(output, logger2, globalOpts.verbose ?? false);
-    if (userTier === "free") {
+    if (!isPro2) {
       logger2.newline();
       logger2.info(chalk9.cyan("Tip: Upgrade to Pro for more rules and AI Contract"));
       logger2.dim("  - 20 rules instead of 5");
       logger2.dim("  - AI Contract with forbidden/required patterns");
       logger2.dim("  - Security, performance, and testing rules");
+      logger2.dim("  Run: vibecheck upgrade");
     }
     logger2.newline();
     logger2.success("Forge complete! Your AI assistant now has accurate project context.");
@@ -93376,7 +95195,6 @@ function getTierLimit(tier) {
   };
   return limits[tier];
 }
-init_credentials();
 var API_BASE = process.env.VIBECHECK_API_URL || "https://api.vibecheckai.dev";
 function getBadgeUrl(projectId, style, verified) {
   const endpoint = verified ? "verified" : "svg";
@@ -93400,14 +95218,7 @@ async function badgeCommand(options) {
     json: options.json
   });
   const authenticated = isAuthenticated();
-  let isPro = false;
-  if (authenticated) {
-    const credResult = await loadCredentials();
-    if (credResult.success && credResult.credentials) {
-      const tier = credResult.credentials.user?.tier;
-      isPro = tier === "pro" || tier === "enterprise";
-    }
-  }
+  const isPro2 = authenticated ? await isPro() : false;
   if (!options.json && !options.quiet) {
     safeRenderHeader({
       command: "badge",
@@ -93417,9 +95228,9 @@ async function badgeCommand(options) {
       vitals: [
         {
           label: "BADGE STATUS",
-          status: authenticated ? isPro ? "optimal" : "stable" : "warning",
-          value: isPro ? "Pro badges available" : "Basic badges",
-          percentage: isPro ? 100 : 50
+          status: authenticated ? isPro2 ? "optimal" : "stable" : "warning",
+          value: isPro2 ? "Pro badges available" : "Basic badges",
+          percentage: isPro2 ? 100 : 50
         }
       ],
       diagnostics: [
@@ -93428,8 +95239,8 @@ async function badgeCommand(options) {
           message: authenticated ? "Authenticated" : "Not authenticated"
         },
         {
-          level: isPro ? "pass" : "info",
-          message: isPro ? "Verified badges enabled" : "Upgrade for verified badges"
+          level: isPro2 ? "pass" : "info",
+          message: isPro2 ? "Verified badges enabled" : "Upgrade for verified badges"
         }
       ]
     });
@@ -93484,7 +95295,7 @@ async function badgeCommand(options) {
       markdown: getMarkdownEmbed(projectId, style, false),
       html: getHtmlEmbed(projectId, style, false)
     },
-    verified: isPro ? {
+    verified: isPro2 ? {
       url: getBadgeUrl(projectId, style, true),
       markdown: getMarkdownEmbed(projectId, style, true),
       html: getHtmlEmbed(projectId, style, true)
@@ -93500,14 +95311,14 @@ async function badgeCommand(options) {
   console.log("");
   console.log(chalk9.cyan("  " + badges.basic.markdown));
   console.log("");
-  if (isPro && badges.verified) {
+  if (isPro2 && badges.verified) {
     console.log(chalk9.bold("  \u2705 Verified Badge ") + chalk9.dim("(Pro)"));
     console.log("");
     console.log(chalk9.dim("  Shows verified status with detailed score:"));
     console.log("");
     console.log(chalk9.cyan("  " + badges.verified.markdown));
     console.log("");
-  } else if (!isPro) {
+  } else if (!isPro2) {
     console.log("");
     console.log(chalk9.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     console.log("");
@@ -93544,7 +95355,7 @@ init_scoring();
 init_truthpack();
 
 // ../../packages/core/dist/firewall/index.js
-init_chunk_YK33YEF4();
+init_chunk_4MEEGNJS();
 init_chunk_DFJL4MLU();
 init_chunk_SKXQ6JUA();
 init_chunk_4EQXFW4J();
@@ -93643,7 +95454,7 @@ async function certifyCommand(options) {
     result.verdict = result.score >= threshold ? "CERTIFIED" : result.score >= 70 ? "NEEDS_WORK" : "NOT_READY";
     result.passed = result.verdict === "CERTIFIED";
     result.duration = Date.now() - startTime;
-    result.proofBundlePath = await generateProofBundle(context, result, projectRoot);
+    result.proofBundlePath = await generateProofBundle2(context, result, projectRoot);
     if (result.passed) {
       const outputDir = options.output ?? path18__default.join(projectRoot, ".vibecheck", "certification");
       result.certificatePath = await generateCertificate(context, result, outputDir);
@@ -94097,7 +95908,7 @@ function generateBadgeUrl(projectId, score) {
   const label = score >= 85 ? "certified" : "score";
   return `https://img.shields.io/badge/VibeCheck-${label}%20${score}%25-${color}`;
 }
-async function generateProofBundle(context, result, projectRoot) {
+async function generateProofBundle2(context, result, projectRoot) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const bundleName = `proof_${timestamp}`;
   const proofsDir = path18__default.join(projectRoot, ".vibecheck", "proofs");
@@ -94348,22 +96159,25 @@ async function realityRunCommand(options) {
   const startTime = Date.now();
   const runId = nanoid(12);
   try {
-    const userTier = getCurrentTier();
-    if (userTier === "free") {
+    const entitlements = await checkEntitlements();
+    if (!entitlements.isPro) {
       if (options.json) {
         console.log(JSON.stringify({
           success: false,
           error: "Pro feature required",
-          message: "Reality Mode is a Pro feature. Upgrade to unlock runtime verification.",
-          upgradeUrl: "https://vibecheck.dev/pricing"
+          code: "UPGRADE_REQUIRED",
+          entitlement: "reality_mode",
+          message: "Reality Mode requires Pro. Upgrade to unlock runtime verification.",
+          upgradeUrl: "https://app.vibecheck.dev/checkout?plan=pro"
         }, null, 2));
       } else {
         logger2.error("");
-        logger2.error(colors.error("  Reality Mode is a Pro feature"));
+        logger2.error(colors.error("  Reality Mode requires Pro"));
         logger2.error("");
-        logger2.error(colors.muted("  Runtime verification with proof bundles requires Pro tier."));
+        logger2.error(colors.muted("  Runtime verification with proof bundles requires Pro."));
         logger2.error("");
-        logger2.error(colors.info("  Upgrade to Pro: https://vibecheck.dev/pricing"));
+        logger2.error(colors.info("  Upgrade: vibecheck upgrade"));
+        logger2.error(colors.info("  Or visit: https://app.vibecheck.dev/checkout?plan=pro"));
         logger2.error("");
       }
       process.exit(1);
@@ -95027,8 +96841,7 @@ async function findLatestProofBundle() {
   return bundles.length > 0 ? bundles[0].name : null;
 }
 async function openReplayViewer(bundlePath, runId, logger2, options) {
-  const currentTier = getCurrentTier();
-  const hasFull = currentTier === "pro" || currentTier === "enterprise";
+  const hasFull = isProSync();
   if (!hasFull && !options.json) {
     console.log("");
     console.log(chalk9.cyan("\u2713") + " Replay viewer available");
@@ -95036,7 +96849,7 @@ async function openReplayViewer(bundlePath, runId, logger2, options) {
     console.log(chalk9.dim("  Free tier: Basic run summary"));
     console.log(chalk9.dim("  Pro tier: Full video + timeline + request trace"));
     console.log("");
-    console.log(chalk9.dim(`  Upgrade: ${chalk9.cyan("https://app.vibecheckai.dev/upgrade")}`));
+    console.log(chalk9.dim(`  Upgrade: vibecheck upgrade`));
     console.log("");
   }
   const existingReport = path18__default.join(bundlePath, "report.html");